ERPNext Stored Cross-Site Scripting Vulnerability in CSV Import Mechanism

A stored cross-site scripting vulnerability has been identified in ERPNext versions through 15.88.1. This issue arises within the CSV import feature when the 'Update Existing Records' option is selected. An attacker can inject malicious JavaScript into a CSV field, which is then saved in the database. The injected script executes when the affected record is viewed in the ERPNext web interface, potentially compromising user sessions or allowing unauthorized actions on behalf of the user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected record.