Frappe EUVD-2026-25071

Q: What is the CVSS score of EUVD-2026-25071?

EUVD-2026-25071 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-3673 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Fluid Attacks

GHSA-qg6x-fw6m-9qrp

XSS Frappe

4.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 23, 2026 - 07:05 vuln.today

CVSS changed

Apr 22, 2026 - 20:22 NVD

4.6 (MEDIUM)

EUVD ID Assigned

Apr 22, 2026 - 20:01 euvd

EUVD-2026-25071

Analysis Generated

Apr 22, 2026 - 20:01 vuln.today

CVE Published

Apr 22, 2026 - 19:32 nvd

MEDIUM 4.6

DescriptionCVE.org

An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping. This issue affects Frappe: 16.10.10.

AnalysisAI

Stored cross-site scripting (XSS) in Frappe 16.10.10 allows authenticated attackers with high privileges to inject malicious JavaScript via crafted tag values in the _user_tags field, which execute when victims open list or report views. The vulnerability stems from unescaped interpolation of tag content into HTML attributes and element content. Exploitation requires user interaction (victim must open affected view) and high-level authentication, but results in session hijacking or data theft with partial technical impact; CISA SSVC framework rates this as exploitable via proof-of-concept with partial technical impact.

Technical ContextAI

Frappe is a Python-based web application framework that handles data rendering in list and report views. The vulnerability exists in the tag rendering component where the _user_tags field (a user-defined metadata field) is interpolated directly into HTML without sanitization. The root cause is improper output encoding (CWE-79, Improper Neutralization of Input During Web Page Generation). When tags are displayed in list or report contexts, the renderer treats tag content as trusted, embedding it into both HTML element content and attribute values without escaping special characters (< > " ') or encoding entities. This allows stored payloads to break out of their intended context and execute arbitrary JavaScript in the victim's browser within the security context of the Frappe application.

RemediationAI

Upgrade Frappe to a patched version released after 16.10.10. The primary fix is vendor patching of the tag renderer to implement proper output encoding using context-aware escaping (HTML entity encoding for element content, attribute-value escaping for attributes). Until a patch is available, implement compensating controls: (1) Restrict _user_tags field editing to trusted users only via role-based access control (trade-off: reduces metadata flexibility), (2) Implement Content Security Policy (CSP) with script-src 'self' directive to block inline script execution (trade-off: requires testing with Frappe's dynamic JavaScript, may break legitimate functionality), (3) Disable or hide tag rendering in list/report views by removing the tag display component from templates (trade-off: loses tag functionality in those views). For immediate tactical defense, audit user accounts with tag-editing permissions and remove high-privilege credentials for inactive or shared accounts. The Fluid Attacks advisory (https://fluidattacks.com/es/advisories/silvio) and Frappe GitHub repository should be monitored for patch release announcements.