From 53394478d9a4d66e29b06d3f5c81a4cc97efd217 Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Tue, 18 Aug 2026 22:49:10 +0530
Subject: [PATCH] fix: escape pathname and document name in transaction row
 link

---
 erpnext/templates/includes/transaction_row.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/erpnext/templates/includes/transaction_row.html b/erpnext/templates/includes/transaction_row.html
index 061c9bd1796..e8f71391b1c 100644
--- a/erpnext/templates/includes/transaction_row.html
+++ b/erpnext/templates/includes/transaction_row.html
@@ -25,5 +25,5 @@
 			</div>
 		{% endif %}
 	</div>
-	<a class="transaction-item-link" href="/{{ pathname }}/{{ doc.name }}">Link</a>
+	<a class="transaction-item-link" href="/{{ pathname | e }}/{{ doc.name | e }}">Link</a>
 </div>