EUVD-2026-38806
GHSA-pxqv-w3qh-9f5m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges required to plant payload via Number Card; victim interaction needed to trigger; scope changes to victim browser with low C/I impact and no availability effect.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component.
AnalysisAI
Stored XSS in Frappe Framework version 17.0.0-dev allows a high-privileged authenticated user to inject malicious JavaScript through the Number Card dashboard component, which subsequently executes in other authenticated users' browser sessions when they view affected dashboards. The CVSS 4.0 score of 4.6 (Medium) reflects the dual constraint of requiring high-privilege credentials to plant the payload and active victim interaction to trigger it - both of which meaningfully limit real-world exploitability. No public exploit code or CISA KEV listing is identified at time of analysis; this was reported by Fluid Attacks.
Technical ContextAI
Frappe Framework (CPE: cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:*) is an open-source full-stack Python and JavaScript web framework that serves as the foundation for ERPNext and several other business applications. The Number Card is a configurable dashboard widget allowing privileged users to define data visualizations and metrics displayed across shared dashboards. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) identifies the root cause: user-controlled data submitted during Number Card configuration is persisted to the database and later injected into rendered page output without adequate output encoding, allowing arbitrary JavaScript to execute in the browser context of any user who views the affected card. The CVSS 4.0 subsequent-system impact metrics (SC:L, SI:L) confirm the classic stored XSS pattern where the vulnerable system stores the payload but the harm materializes in other users' sessions.
RemediationAI
No vendor-released patch version has been identified at time of analysis. The Frappe GitHub repository (https://github.com/frappe/frappe) should be monitored for a fix commit or tagged release that addresses unsafe evaluation of user-controlled data in the Number Card component. As an interim compensating control, restrict the ability to create or modify Number Cards to the smallest possible set of explicitly trusted administrators, shrinking the set of accounts capable of planting a payload - note this may impact legitimate dashboard management workflows. Deploying a strict Content Security Policy (CSP) header that disallows inline script execution is the most broadly effective control for stored XSS classes; however, Frappe's JavaScript-heavy UI may rely on inline scripts, requiring careful testing before enabling script-src restrictions in production. Existing Number Card configurations should be audited for unexpected or obfuscated script content. Review the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/sum41 for additional vendor guidance as it is published.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today