CVE-2026-32712 opensourcepos CVE debrief

Who should care

Users of Open Source Point of Sale (3.4.2 and earlier) should apply the patch in version 3.4.3 to prevent XSS attacks. Operators, platform administrators, vulnerability management teams, and security teams should review and prioritize this vulnerability based on exposure and potential impact.

Technical summary

The vulnerability exists due to the customer_name column being configured with escape: false in the bootstrap-table column configuration. This allows an attacker to inject arbitrary JavaScript into a customer's first_name or last_name field, which is then executed in the browser of any user viewing the Daily Sales page. The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. Affected product context indicates Open Source Point of Sale versions 3.4.2 and earlier are vulnerable.

Defensive priority

Apply the patch in version 3.4.3 to prevent XSS attacks. Restrict customer management permissions and monitor for suspicious activity on the Daily Sales page.

Recommended defensive actions

• Apply the patch in version 3.4.3
• Restrict customer management permissions
• Monitor for suspicious activity on the Daily Sales page
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-07T21:17:16.430Z and last modified on 2026-07-24T23:10:00.563Z. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD information. Defenders should verify Open Source Point of Sale version and patch status.

Official resources