EUVD-2026-25071
GHSA-qg6x-fw6m-9qrp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping. This issue affects Frappe: 16.10.10.
AnalysisAI
Stored cross-site scripting (XSS) in Frappe 16.10.10 allows authenticated attackers with high privileges to inject malicious JavaScript via crafted tag values in the _user_tags field, which execute when victims open list or report views. The vulnerability stems from unescaped interpolation of tag content into HTML attributes and element content. Exploitation requires user interaction (victim must open affected view) and high-level authentication, but results in session hijacking or data theft with partial technical impact; CISA SSVC framework rates this as exploitable via proof-of-concept with partial technical impact.
Technical ContextAI
Frappe is a Python-based web application framework that handles data rendering in list and report views. The vulnerability exists in the tag rendering component where the _user_tags field (a user-defined metadata field) is interpolated directly into HTML without sanitization. The root cause is improper output encoding (CWE-79, Improper Neutralization of Input During Web Page Generation). When tags are displayed in list or report contexts, the renderer treats tag content as trusted, embedding it into both HTML element content and attribute values without escaping special characters (< > " ') or encoding entities. This allows stored payloads to break out of their intended context and execute arbitrary JavaScript in the victim's browser within the security context of the Frappe application.
RemediationAI
Upgrade Frappe to a patched version released after 16.10.10. The primary fix is vendor patching of the tag renderer to implement proper output encoding using context-aware escaping (HTML entity encoding for element content, attribute-value escaping for attributes). Until a patch is available, implement compensating controls: (1) Restrict _user_tags field editing to trusted users only via role-based access control (trade-off: reduces metadata flexibility), (2) Implement Content Security Policy (CSP) with script-src 'self' directive to block inline script execution (trade-off: requires testing with Frappe's dynamic JavaScript, may break legitimate functionality), (3) Disable or hide tag rendering in list/report views by removing the tag display component from templates (trade-off: loses tag functionality in those views). For immediate tactical defense, audit user accounts with tag-editing permissions and remove high-privilege credentials for inactive or shared accounts. The Fluid Attacks advisory (https://fluidattacks.com/es/advisories/silvio) and Frappe GitHub repository should be monitored for patch release announcements.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportv
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the fra
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. Rated medium severity (CVSS
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and
SQL injection in Frappe framework before 15.84.0/14.99.0.
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. Rated critical severity (CVSS 9.8), this vulner
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execu
SQL injection in Frappe's bulk_update function enables unauthenticated remote attackers to execute arbitrary SQL command
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today