VulnSocial

CVE-2026-42839Disclosure

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and trigger unescaped rendering in the Point of Sale (POS) cart interface for every operator who adds that item to a transaction.This issue affects ERPNext: 16.16.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-04); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-04: 2Mentions · 2026-06-15: 1Technical Details · 2026-06-04: 206-0406-15
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-042
Disclosure2
2026-06-151
Disclosure1
Full discourse3 posts
  • Fluid Attacks@fluidattacks
    Disclosure

    🚨 New zero-day in ERPNext | Detected by our AI SAST scanner and disclosed by Oscar Uribe. As a #CNA, we assigned the ID CVE-2026-42839. Details: 🔗https://fluidattacks.com/es/advisories/pink. We have announced 239 #CVEs to this date: 🔗 https://fluidattacks.com/advisories/ https://t.co/Z1YnaJ6iHO

    Post summary

    The message announces a newly identified zero‑day in ERPNext, assigns CVE‑2026‑42839, and provides a link to the advisory, but offers no technical or exploitation details.

    0000044
    869 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-42839 An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and tr… https://www.cve.org/CVERecord?id=CVE-2026-42839 ----- Traducción: CVE-2026-42839 Un … http://infoflow.cloud`

    Post summary

    A new CVE (CVE‑2026‑42839) is disclosed, revealing that authenticated ERPNext users with item edit rights can inject arbitrary HTML/JavaScript into item fields.

    0000029
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-42839 An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and tr… https://www.cve.org/CVERecord?id=CVE-2026-42839

    Post summary

    CVE-2026-42839 is a disclosed repository‑level stored XSS flaw in ERPNext that permits authenticated users with Item edit rights to persist arbitrary HTML/JavaScript in item item_name, description, or image fields.

    00000196
    57.6K followersView on X

Explore more

Back to dashboard