Vulnerability Report

CVE-2025-65924

Title: HTML tag injection in ERPNext generated PDF documents

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2025-65924.

CWE Category NVD-CWE-noinfo

Published Date Feb 03, 2026

Modified Date Feb 17, 2026

Exploit Status Not Found

Score 4.1 CVSS v

Exploit Probability (EPSS)

0.23%

Vulnerability Summary

CVE-2025-65924: ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.

Impacted Vendors

frappe 1

erpnext 1

Reference Links

https://github.com/frappe/frappe_docker.git

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity MEDIUM

4.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns