ERPNext Arbitrary HTML/JavaScript Injection Vulnerability in Point of Sale Cart Interface

A vulnerability exists in ERPNext version 16.16.0, allowing authenticated users with permission to edit Item records to inject arbitrary HTML or JavaScript. This injected content is rendered without proper escaping in the Point of Sale (POS) cart interface, affecting all operators who add the modified item to a transaction. The exploitation occurs through the item_name, description, or image fields of the Item record.

Impact

Exploitation of this vulnerability allows for cross-site scripting (XSS) attacks, where injected scripts are executed in the context of the user's browser.