EUVD-2026-38795
GHSA-5h93-rrcv-vggv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privilege required to write Auto Repeat records (PR:H); victim must open the form (UI:R); scope changes to victim browser (S:C) with low C/I impact; no availability impact applies.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in reference_document using a whitelisted write path and trigger script execution when users open the affected Auto Repeat form.
AnalysisAI
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated attacker with write access to the Auto Repeat module to inject persistent HTML/JavaScript into the reference_document field via a whitelisted write path, bypassing server-side input controls. When any user opens the affected Auto Repeat form, the injected payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized UI manipulation on behalf of the victim. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; however, the stored (persistent) nature of this XSS makes it more dangerous than reflected variants within shared Frappe deployments.
Technical ContextAI
Frappe Framework is an open-source Python/JavaScript full-stack web framework that underpins ERPNext and related Frappe-ecosystem business applications. The Auto Repeat module allows users to schedule repeating documents, and its reference_document field is the injection vector. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the root cause: user-supplied input is stored without adequate sanitization and later rendered without output encoding, resulting in browser-executable script. The phrase 'whitelisted write path' in the description suggests the framework's permission model allowed the write but the input sanitization layer did not strip or encode HTML/JavaScript constructs. The affected build is version 17.0.0-dev (a pre-release development snapshot), per the CPE cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:*, though the wildcard version range means impact on stable releases has not been precisely bounded by available data.
RemediationAI
No vendor-released patch has been identified at time of analysis; a confirmed fix version is not available from the provided references. Organizations running Frappe Framework 17.0.0-dev with Auto Repeat enabled should monitor the upstream repository at https://github.com/frappe/frappe for patches or commits addressing reference_document input sanitization. As compensating controls: restrict write access to the Auto Repeat module to the smallest set of operationally necessary, trusted accounts (noting this may limit document scheduling workflows for broader user populations); implement a strict Content Security Policy (CSP) header on the Frappe application to constrain script execution origins and reduce XSS payload impact even if injection occurs; and consider disabling the Auto Repeat feature entirely if it is not required, accepting the trade-off of losing document repetition scheduling. None of these controls eliminate the underlying sanitization defect - a vendor-issued patch addressing output encoding at the reference_document rendering layer is the definitive fix.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today