From 06a753faf309cc237ead9fefd1a74ee9c701ecb0 Mon Sep 17 00:00:00 2001
From: Mihir Kandoi <kandoimihir@gmail.com>
Date: Sat, 1 Aug 2026 09:11:37 +0530
Subject: [PATCH] fix: escape item code and UOM in the supplier dialog errors

Desk renders a client side message as HTML, so an Item or UOM whose name holds
markup ran as markup in the buyer's session.

(cherry picked from commit 21c6d10ad3c99c44c612cc34b6f1f30208ecfd61)
---
 .../material_request/material_request.js      | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/erpnext/stock/doctype/material_request/material_request.js b/erpnext/stock/doctype/material_request/material_request.js
index 3948362d4f3..787ea536811 100644
--- a/erpnext/stock/doctype/material_request/material_request.js
+++ b/erpnext/stock/doctype/material_request/material_request.js
@@ -524,23 +524,30 @@ frappe.ui.form.on("Material Request", {
 					frappe.throw(__("Select at least one Item"));
 				}
 
+				const item_link = (row) =>
+					frappe.utils.get_form_link(
+						"Item",
+						row.item_code,
+						true,
+						frappe.utils.escape_html(row.item_code)
+					);
+
 				const missing_supplier = item_suppliers.find((row) => !row.supplier);
 				if (missing_supplier) {
-					frappe.throw(
-						__("Select a Supplier for Item {0}", [
-							frappe.utils.get_form_link("Item", missing_supplier.item_code, true),
-						])
-					);
+					frappe.throw(__("Select a Supplier for Item {0}", [item_link(missing_supplier)]));
 				}
 
 				const invalid_qty = item_suppliers.find(
 					(row) => flt(row.qty) <= 0 || flt(row.qty) > flt(row.pending_qty)
 				);
 				if (invalid_qty) {
+					const pending_qty = `${format_number(invalid_qty.pending_qty)} ${frappe.utils.escape_html(
+						invalid_qty.uom
+					)}`;
 					frappe.throw(
 						__("Quantity for Item {0} must be greater than zero and cannot exceed {1}", [
-							frappe.utils.get_form_link("Item", invalid_qty.item_code, true),
-							`<b>${format_number(invalid_qty.pending_qty)} ${invalid_qty.uom}</b>`,
+							item_link(invalid_qty),
+							`<b>${pending_qty}</b>`,
 						])
 					);
 				}