Frappe Framework CVE-2026-50705

Q: What is the CVSS score of CVE-2026-50705?

CVE-2026-50705 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38802 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Fluid Attacks

GHSA-x6g9-3r4x-w7cx

XSS Frappe Frappe Framework

4.6

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

High privileges required to edit the headline field; victim interaction required to trigger; scope change to victim browser with low C/I impact and no A impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 15:54 vuln.today

DescriptionCVE.org

A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer.

AnalysisAI

Cross-site scripting in Frappe Framework 17.0.0-dev allows a high-privileged attacker who can modify the Form Dashboard headline to inject malicious JavaScript that executes in the browsers of other users who subsequently view the affected form. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation is gated behind two significant barriers: attacker must hold high-privilege application credentials and a victim must actively navigate to the injected form. No public exploit code and no active exploitation (CISA KEV) have been identified at the time of analysis; this was reported by Fluid Attacks.

Technical ContextAI

Frappe Framework is an open-source Python full-stack web framework that powers ERPNext and other business applications. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored or reflected XSS root cause where user-controlled data is embedded in HTML output without adequate sanitization or encoding. The specific injection point is the Form Dashboard headline renderer - a UI component that displays contextual metadata atop Frappe forms. The affected product is identified via CPE cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:* (wildcard version), with the description explicitly naming version 17.0.0-dev as affected. The CVSS 4.0 scope metrics (VC:N/VI:N/VA:N with SC:L/SI:L) model the classic XSS pattern: no direct server-side impact, but low confidentiality and integrity impact on the subsequent system - the victim's browser context.

RemediationAI

No vendor-released patch has been identified at the time of analysis; the affected version is Frappe Framework 17.0.0-dev and no fixed release version is confirmed in the available data. Organizations should monitor the Frappe GitHub repository at https://github.com/frappe/frappe for commits addressing input sanitization in the Form Dashboard headline renderer, and review the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/aterciopelados for vendor response updates. As a compensating control, restrict Form Dashboard headline editing capability to the smallest possible set of fully trusted administrators, directly reducing the attacker population enabled by the PR:H requirement. Deploying a strict Content Security Policy (CSP) header that disallows inline scripts ('script-src self') can limit XSS impact even if injection succeeds, though this may break legitimate Frappe UI functionality and should be tested in a staging environment before production rollout.