Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M

CVE-2026-53575EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

Low 2.7

In plain English

A low-severity cross-site scripting in espocrm from espocrm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.2%top 86.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowing attacker-controlled JavaScript to run in users' sessions and leak page data, including unsaved user input. This issue is fixed in version 9.3.9.

Affected products (as reported)

Vendor	Product	Versions
espocrm	espocrm	< 9.3.9

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/espocrm/espocrm/security/advisories/GHSA-f34h-xxmv-j9xp x_refsource_CONFIRM
https://github.com/espocrm/espocrm/commit/ce73338ea7b463914e1271f16f8f73131ace886f x_refsource_MISC
https://github.com/espocrm/espocrm/releases/tag/9.3.9 x_refsource_MISC