CVE-2026-42839: Frappe Erpnext

Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and trigger unescaped rendering in the Point of Sale (POS) cart interface for every operator who adds that item to a transaction.This issue affects ERPNext: 16.16.0.

Affected products

• Frappe Erpnext: version 16.16.0 only

Published 2026-06-03. Last modified 2026-07-22.