Frappe CVE-2026-3837

The attacker must possess authenticated access with high privilege level (e.g., document creator or editor role) to persist malicious values into document fields. The vulnerable formatter implementation must be active for the specific field type in which the payload is injected - formatters are field-type-specific, so not all fields are equally vulnerable. A second user must subsequently open the affected document in the Desk interface for the XSS payload to execute; the payload does not activate during storage or in API-only contexts. Modern browsers with strict CSP or script filtering may prevent payload execution even if injection succeeds. Default Frappe installations without additional security configuration (e.g., CSP headers) are fully vulnerable once an authenticated high-privilege attacker injects a payload.

Real-world risk is moderate despite the low CVSS score, due to several mitigating and aggravating factors. CVSS vector AV:N/AC:L/PR:H/UI:A indicates network-accessible exploitation requiring high privileges and user interaction (victim must open document). These constraints substantially reduce attack surface compared to unauthenticated RCE. However, the high-privilege requirement (PR:H) is context-dependent: in many Frappe deployments, 'high privilege' may include document creators, managers, or power users - a broader population than CVSS implies. The stored XSS nature (UI:A requires victim interaction, not attacker) is a compounding factor: once malicious data is persisted, it activates against any user with document access, enabling supply-chain-like attacks where a compromised or malicious privileged user poisons shared documents. EPSS data is not provided, but exploitation probability is elevated above raw CVSS due to: (1) no patch version identified in input data, meaning all Frappe 16.10.0 deployments remain vulnerable indefinitely pending upstream fix; (2) XSS is highly reliable to exploit and difficult to detect without robust CSP; (3) Frappe's multi-user, document-centric architecture maximizes the blast radius once stored XSS is injected. Limiting factors: authentication requirement and privilege level (PR:H) gate initial injection; user action required to trigger payload; modern browsers with CSP may mitigate execution. Not confirmed as actively exploited (KEV status not provided), and no public POC identified in input data, suggesting nascent vulnerability. Priority should be moderate-to-high for organizations with multi-user Frappe deployments and significant data-sharing patterns.

An attacker with document creation/editing privileges (e.g., a disgruntled employee or compromised user account) crafts a malicious payload in a field (e.g., a URL field, label, or custom HTML-rendered field) and saves the document. When a colleague or manager opens the same document in Desk to review or collaborate, the formatter renders the unescaped payload into the HTML page, triggering JavaScript execution in the victim's browser with the victim's session context and privileges. The attacker's script can exfiltrate session tokens, modify document data on behalf of the victim, or redirect to a phishing site.