---
id: CVE-2026-48540
title: >-
  Krayin CRM through 2.2.6 contains a stored client-side template injection
  vulnerability that allows authenticated attackers to execute arbitrary
  JavaScript in other users' browsers by injecting Vue.js template expressions
  into the lead t…
summary: >-
  Krayin CRM through 2.2.6 contains a stored client-side template injection
  vulnerability that allows authenticated attackers to execute arbitrary
  JavaScript in other users' browsers by injecting Vue.js template expressions
  into the lead t…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: krayin
product: laravel-crm
affected:
  - laravel-crm <= 2.2.6
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:55.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48540'
references:
  - url: >-
      https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-lead-title
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T19:35:00.774527Z'
ingestedAt: '2026-09-24T19:50:30.726Z'
---

## Overview

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.