EUVD-2026-38803
GHSA-649m-3hjq-ppg8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege account required (PR:L), victim must load the stored payload (UI:R), scope changes to victim browser (S:C) enabling limited confidentiality and integrity impact; no availability impact applies.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component.
AnalysisAI
Stored XSS in Frappe Framework 17.0.0-dev's MultiSelectDialog component allows authenticated low-privileged attackers to inject persistent malicious scripts that execute in other users' browsers when the compromised UI element is rendered. Per the CVSS 4.0 vector (PR:L/UI:A/SC:L/SI:L), exploitation requires a valid low-privilege account and active victim interaction, but the scope change to the subsequent system confirms cross-user impact on confidentiality and integrity. No public exploit code and no CISA KEV listing exist at time of analysis; the 17.0.0-dev designation suggests exposure may currently be limited to pre-release or development deployments.
Technical ContextAI
Frappe Framework is a full-stack Python and JavaScript web application platform primarily used to build ERPNext and other enterprise applications. The MultiSelectDialog is a reusable UI widget that renders user-selectable record lists within the framework's web interface. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled data submitted through the MultiSelectDialog is stored without adequate sanitization and subsequently rendered in victim browsers without proper output encoding, enabling persistent script injection. The CPE string cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:* uses a wildcard version, but the description anchors the confirmed affected release to 17.0.0-dev specifically. The CVSS 4.0 scope model (VC:N/VI:N/VA:N vs SC:L/SI:L/SA:N) correctly reflects that the vulnerable system itself is not directly compromised - the impact propagates to the subsequent system (victim browser/session).
RemediationAI
No vendor-released patch has been identified at time of analysis; the fix status should be monitored via the upstream GitHub repository at https://github.com/frappe/frappe and the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/extremoduro. As a compensating control, restricting write access to the MultiSelectDialog component to only highly-trusted users reduces the attacker's ability to inject stored payloads, though this may limit legitimate application functionality. Enforcing a strict Content Security Policy (CSP) that prohibits inline script execution and restricts script sources to known origins is the most impactful mitigation for XSS impact reduction, but requires careful tuning to avoid breaking Frappe's JavaScript-heavy interface. WAF rules targeting common XSS payloads in form fields can provide an additional detection and blocking layer, with the trade-off of potential false positives on legitimate rich-text inputs. Organizations running 17.0.0-dev in production should consider pinning to the last confirmed-stable release until a patch is available.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today