EUVD-2026-38794
GHSA-7g37-3vxg-pc3v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privilege required to store payload and victim interaction required to trigger; scope changes to victim browser, yielding low C/I with no server-side availability impact.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component.
AnalysisAI
Stored XSS in Frappe Framework 17.0.0-dev allows a high-privileged authenticated attacker to inject persistent malicious scripts into the Audit Trail component, which then execute in the browsers of other privileged users who view that trail. The vulnerability arises from improper input neutralization (CWE-79) before HTML rendering in the audit logging subsystem, and is assigned a CVSS 4.0 score of 4.6 reflecting the high-privilege prerequisite and required victim interaction. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Technical ContextAI
Frappe is a full-stack Python/JavaScript open-source web framework (CPE: cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:*) that serves as the foundation for ERPNext and a range of business applications. The Audit Trail component records privileged user actions for compliance and accountability purposes, and its output is rendered in the browser for administrative review. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) identifies the root cause: user-controlled data written into audit entries is stored and later rendered without adequate HTML encoding or sanitization, allowing injected script tags or event handlers to survive storage and execute upon page load. Because the Audit Trail is typically consumed by administrators and system managers, the execution context is a privileged user session.
RemediationAI
No vendor-released patch version has been confirmed from the available data; the upstream Frappe repository at https://github.com/frappe/frappe should be monitored for commits or tagged releases that address stored XSS in the Audit Trail component. The Fluid Attacks advisory at https://fluidattacks.com/es/advisories/rufus may contain additional remediation detail. As compensating controls: enforce a strict Content Security Policy (CSP) header on all Frappe deployments that disables inline script execution (script-src 'self'), which will block injected payloads from running even if stored - note that CSP changes may break legitimate inline scripts in the application and require testing. Restrict Audit Trail access to the minimum necessary set of privileged users, reducing the pool of potential victims. Audit existing trail entries for anomalous HTML or script content and sanitize as needed.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today