Frappe CVE-2026-109602

Exploitation requires an authenticated account with permission to create or edit a dashboard chart and set its filter values - the exact vulnerable feature is the dashboard chart filter input, which jQuery renders as rich text instead of escaping it. Execution additionally requires a second user to open and view the attacker-controlled dashboard chart (UI:P / UI:R), so the payload does not fire without victim interaction. Limiting factors: the attacker must already hold valid credentials with chart-editing rights, impact is confined to the viewing user's browser session (no direct server compromise), and the affected versions are Frappe before 15.118.0 and 16.x before 16.31.0, so patched or non-dashboard deployments are not exposed.

This is a medium-severity stored XSS (CWE-79) with a CVSS 4.0 base score of 5.1. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) indicates a network-reachable, low-complexity attack that nonetheless requires the attacker to be authenticated (PR:L) and requires a victim to passively view the affected dashboard chart (UI:P). Impact is constrained: the vulnerable-system confidentiality/integrity/availability are all None (VC:N/VI:N/VA:N) and only subsequent-system confidentiality and integrity are Low (SC:L/SI:L/SA:N), reflecting script execution in a victim's browser session rather than compromise of the Frappe server itself. No EPSS score, KEV listing, SSVC decision, or POC indicator was supplied in the input; the issue is not on CISA KEV and no public exploit was referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent - no network-vs-local or auth contradictions - and point to a real but moderate risk: it depends on a malicious or compromised authenticated account and social/workflow conditions (a victim viewing the attacker-controlled chart), making it more of a privilege-escalation / session-abuse concern in multi-tenant or multi-user deployments than a mass-exploitable critical flaw. EPSS data is missing, so widespread-exploitation probability cannot be quantified from the input.

An authenticated low-privilege Frappe user creates or edits a dashboard chart and enters a malicious payload as a filter value, which jQuery renders as rich text rather than escaping it. When a higher-privileged user (e.g. an administrator) later opens that dashboard chart, the stored script executes in their browser session, enabling session-context actions or data theft. No public exploit code was referenced in the provided data.