XSS in Frappe Erpnext
CVE-2025-65924
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.
EPSS: 0.002 (13.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N.
Affected products
- Frappe Erpnext
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Product)
Frequently asked questions
- What is CVE-2025-65924?
- CVE-2025-65924 is a medium-severity vulnerability in Frappe Erpnext, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 4.1/10. Published 2026-02-03.
- How severe is CVE-2025-65924?
- Medium severity. CVSS v3 base score is 4.1 out of 10.