---
id: CVE-2026-48543
title: >-
  Krayin CRM through 2.2.6 contains a stored client-side template injection
  vulnerability that allows authenticated attackers to execute arbitrary
  JavaScript in other users' browsers by injecting Vue.js template expressions
  into the web fo…
summary: >-
  Krayin CRM through 2.2.6 contains a stored client-side template injection
  vulnerability that allows authenticated attackers to execute arbitrary
  JavaScript in other users' browsers by injecting Vue.js template expressions
  into the web fo…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: krayin
product: laravel-crm
affected:
  - laravel-crm <= 2.2.6
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:55.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48543'
references:
  - url: >-
      https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-web-form-description
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T19:50:30.727Z'
---

## Overview

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.