CVE-2026-42840: Frappe Erpnext

Medium severity, CVSS 5.1. EPSS: 0.4% chance of exploitation in the next 30 days.

An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) interface for every operator who selects that customer. This issue affects ERPNext: 16.16.0.

Affected products

• Frappe Erpnext: version 16.16.0 only

Published 2026-06-03. Last modified 2026-07-22.