---
id: CVE-2026-53575
title: EspoCRM is an open source customer relationship management application
summary: >-
  EspoCRM is an open source customer relationship management application. Prior
  to 9.3.9, an authenticated administrator can place crafted content in the
  applicationName setting through CSP nonce injection. The persistent injection
  is inse…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-79
vendor: espocrm
product: espocrm
affected:
  - espocrm < 9.3.9
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:18:12.730'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53575'
references:
  - url: >-
      https://github.com/espocrm/espocrm/commit/ce73338ea7b463914e1271f16f8f73131ace886f
    label: security-advisories@github.com
  - url: 'https://github.com/espocrm/espocrm/releases/tag/9.3.9'
    label: security-advisories@github.com
  - url: 'https://github.com/espocrm/espocrm/security/advisories/GHSA-f34h-xxmv-j9xp'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T15:12:46.998461Z'
ingestedAt: '2026-10-15T15:09:08.431Z'
---

## Overview

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowing attacker-controlled JavaScript to run in users' sessions and leak page data, including unsaved user input. This issue is fixed in version 9.3.9.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.