EUVD-2026-38805
GHSA-fhqq-8vpv-ppw5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable stored XSS with scope change affecting victim users; PR:L for required attacker authentication; UI:R for victim panel visit; no availability impact.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Notifications > Events panel.
AnalysisAI
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated low-privileged user to inject persistent JavaScript payloads via the Notifications > Events panel, which execute in the browser context of any user who subsequently views that panel. The CVSS 4.0 vector confirms subsequent-system scope impact (SC:L/SI:L), meaning the attack targets other users rather than the attacker's own session. No public exploit has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
Frappe is a full-stack Python web framework that serves as the foundation for ERPNext and other business applications. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output encoding of user-supplied content before it is rendered in the HTML context. The Notifications > Events panel stores user input server-side and serves it back to other authenticated users without adequate escaping, creating a persistent (stored) XSS condition. The CPE cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:* uses a wildcard version range, suggesting NVD has not yet scoped the fix boundary. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N is structurally consistent with stored XSS: vulnerable-system metrics are N (the server itself is not directly compromised), while subsequent-system metrics SC:L and SI:L capture the confidentiality and integrity impact on victim users' browser sessions.
RemediationAI
No exact patched version number is confirmed in the available data, so a precise upgrade target cannot be stated. Monitor the Frappe GitHub repository at https://github.com/frappe/frappe for commits or releases addressing this issue, and track the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/journey for patch confirmation. As a compensating control, restrict write access to the Notifications > Events panel to the minimum set of highly trusted users, reducing the attacker population; this carries the trade-off of limiting notification management for legitimate users. Implementing a strict Content Security Policy header that blocks inline script execution and restricts script sources can reduce the blast radius of any stored XSS payload that fires before a patch is applied, though Frappe's CSP support should be validated to avoid breaking legitimate framework functionality. Audit existing event entries in the Notifications panel for suspicious script content if compromise is suspected.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today