What is GHSA-hc32-c5xw-9f2m?

GHSA-hc32-c5xw-9f2m is a security advisory published by GitHub Security Advisories with Medium severity. An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML...

Which CVE IDs does GHSA-hc32-c5xw-9f2m cover?

GHSA-hc32-c5xw-9f2m covers the following CVE IDs: CVE-2026-42839. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-hc32-c5xw-9f2mMedium

An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML...

Vendor

GitHub Security Advisories

Published

June 3, 2026

Last Modified

June 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-42839 →

📋 Description

An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and trigger unescaped rendering in the Point of Sale (POS) cart interface for every operator who adds that item to a transaction.This issue affects ERPNext: 16.16.0.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-42839
https://fluidattacks.com/es/advisories/pink
https://github.com/frappe/erpnext
https://github.com/advisories/GHSA-hc32-c5xw-9f2m