Frappe Framework CVE-2026-50703

Q: What is the CVSS score of CVE-2026-50703?

CVE-2026-50703 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38799 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Fluid Attacks

GHSA-xp83-3qxw-8rm6

XSS Frappe Frappe Framework

4.8

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Low privilege to write payload, victim interaction required; scope changes as script executes in other users' browser context with low C/I impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 15:55 vuln.today

DescriptionCVE.org

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer.

AnalysisAI

Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated low-privileged user to inject persistent malicious scripts via the Desk desktop icon renderer, which then execute in the browsers of other users - including administrators - who subsequently view the affected Desk interface. The vulnerability was reported by Fluid Attacks and carries a CVSS 4.0 score of 4.8 (Medium), reflecting cross-user impact limited to the subsequent-system scope (SC:L/SI:L). No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Frappe Framework is a Python/JavaScript full-stack web framework primarily known as the foundation for ERPNext, a widely-used open-source ERP platform. The Desk component serves as the primary user interface and displays desktop icons representing application shortcuts. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant: user-controlled input submitted into icon properties (such as label or name) is persisted to the backend database without adequate sanitization and later rendered in the DOM without proper output encoding. The affected CPE (cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:*) uses a wildcard version, indicating NVD has not precisely bounded the affected range beyond the reported 17.0.0-dev build.

RemediationAI

Upstream fix availability has not been confirmed - no patched release version is cited in the available data, and the GitHub reference (https://github.com/frappe/frappe) does not point to a specific commit or tagged release resolving this issue. Organizations should monitor the Frappe GitHub repository and the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/soja for patch availability. As compensating controls pending a patch: restrict the ability to create or modify Desk desktop icons to trusted administrator roles, reducing the PR:L attack surface to PR:H in practice; enforce a strict Content Security Policy (CSP) header that disallows inline script execution, which would significantly reduce the impact of any XSS payload even if injected; and audit existing custom desktop icons for unexpected or suspicious content. Disabling custom icon creation entirely is the most effective workaround but may disrupt normal user workflows.