Frappe Framework CVE-2026-50700

Q: What is the CVSS score of CVE-2026-50700?

CVE-2026-50700 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38796 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Fluid Attacks

GHSA-g6fv-rq4p-qq28

XSS Frappe Frappe Framework

4.6

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

PR:H reflects mandatory high-privilege access to store the payload; S:C and C:L/I:L capture cross-user browser session impact with no server-side confidentiality or availability breach.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 15:55 vuln.today

DescriptionCVE.org

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function.

AnalysisAI

Stored XSS in Frappe Framework 17.0.0-dev allows high-privileged authenticated attackers to inject persistent malicious scripts via the frappe.get_avatar function, which execute in victims' browsers when the crafted content is rendered. The CVSS 4.0 score of 4.6 (Medium) reflects the PR:H requirement to store the payload and UI:A requirement for victim interaction, with impact limited to subsequent systems (other users' sessions). No public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

Frappe Framework is an open-source full-stack Python/JavaScript web application framework and the base layer for ERPNext and numerous other business applications. The vulnerable component is the frappe.get_avatar function, which renders user-controlled input - likely a name, username, or avatar identifier - into HTML output without adequate sanitization or encoding. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause: attacker-supplied data is persisted server-side and later reflected into a rendered page context where the browser interprets it as executable script rather than inert text. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:A confirms the attack surface is network-accessible but requires high-privilege credentials to inject the payload and active victim browsing to trigger execution. Affected product is identified via CPE cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch version has been identified in the available data; the fix status must be verified directly against the Frappe GitHub repository at https://github.com/frappe/frappe by searching for commits or tagged releases that address sanitization in the frappe.get_avatar function after the 17.0.0-dev baseline. As a compensating control, restrict high-privilege role assignments within the Frappe application to the minimum set of trusted administrators - this reduces the attacker pool capable of injecting payloads but does not eliminate the vulnerability. Implementing a strict Content Security Policy (CSP) header (e.g., script-src 'self') can reduce the exploitability of stored XSS by blocking inline script execution, though this may interfere with legitimate Frappe UI functionality and requires thorough regression testing before deployment. Track the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/caligaris for patch confirmation and fix version details.