ERPNext Cross-Site Scripting Vulnerability in Email Template Engine

A cross-site scripting (XSS) vulnerability has been identified in ERPNext versions through 15.103.1, specifically within the Email Template engine. This issue allows an attacker with the ability to create or edit email templates to inject malicious JavaScript. The injected script is executed in the browser of the victim when the template is used.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the email template.