Is there a patch available for EUVD-2026-36452?

Yes, a patch is available for EUVD-2026-36452. Update the affected software to the latest version immediately.

Frappe Framework EUVD-2026-36452

Q: What is the CVSS score of EUVD-2026-36452?

EUVD-2026-36452 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-47739 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-12 GitHub_M

XSS Frappe

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Stored XSS requires a low-privilege account to author the Note (PR:L) and victim browser interaction to trigger it (UI:R), with scope change affecting the victim's browser session.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 16:01 EUVD

Analysis Generated

Jun 12, 2026 - 14:55 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0.

AnalysisAI

Stored cross-site scripting in the Frappe framework's Note feature allows a low-privileged attacker to persist malicious JavaScript that executes in the browsers of users who subsequently view the poisoned note. All Frappe deployments on the v15 branch prior to 15.106.0 and the v16 branch prior to 16.16.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed patches are available and should be applied promptly given the ease of exploitation once an attacker holds any valid user account.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant. The Frappe framework (cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*) is a Python/JavaScript full-stack web application framework that underpins ERPNext and other business applications. Its Note module failed to sanitize user-supplied content before persisting it to the database and re-rendering it to other users' browsers, allowing arbitrary HTML and JavaScript injection that survives across sessions. Because the payload is stored server-side, every subsequent viewer of the Note is exposed without any further attacker interaction after initial injection.

RemediationAI

Upgrade to Frappe version 15.106.0 or later on the v15 branch, or version 16.16.0 or later on the v16 branch, as confirmed by the vendor advisory at https://github.com/frappe/frappe/security/advisories/GHSA-vxmp-h244-wv3r. If immediate upgrade is not possible, restrict write access to the Note module to administrator-level roles only via Frappe's role-based permission system - this reduces the attack surface to already-trusted users but does not eliminate risk if an admin account is compromised. Deploying a Content Security Policy header that blocks inline script execution can reduce the impact of a successful injection, though Frappe's default CSP configuration may require tuning to avoid breaking application functionality. Note that neither the permission restriction nor the CSP workaround eliminates the underlying sanitization defect.