Is there a patch available for EUVD-2026-36454?

Yes, a patch is available for EUVD-2026-36454. Update the affected software to the latest version immediately.

Frappe Framework EUVD-2026-36454

Q: What is the CVSS score of EUVD-2026-36454?

EUVD-2026-36454 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-44205 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-12 GitHub_M

XSS Frappe

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Profile image upload requires authentication (PR:L); stored XSS triggers only when a victim visits the profile (UI:R); script execution in victim's browser constitutes a scope change (S:C) with low confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 16:01 EUVD

Analysis Generated

Jun 12, 2026 - 14:56 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0.

AnalysisAI

Stored cross-site scripting in Frappe's user profile image section enables script injection that executes in the browsers of any user who views the compromised profile. Affected versions are all Frappe releases prior to 15.106.0. No public exploit code or CISA KEV listing exists at time of analysis; EPSS of 0.02% (7th percentile) reflects low observed exploitation activity, though stored XSS in a shared framework carries inherent persistence risk across all applications built on Frappe.

Technical ContextAI

Frappe is a Python/JavaScript full-stack web application framework used to build business applications such as ERPNext. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the user profile image handling path. Frappe fails to adequately sanitize or encode attacker-controlled content submitted to the profile image section before persisting and later rendering it to other users, allowing HTML/JavaScript injection that is stored server-side and served to every visitor of the affected profile. The CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* confirms all Frappe versions prior to 15.106.0 are in scope regardless of platform or deployment mode.

RemediationAI

Upgrade Frappe to version 15.106.0 or later, which contains the vendor-confirmed patch per the GitHub advisory at https://github.com/frappe/frappe/security/advisories/GHSA-2wx6-8gmq-x4fw. If immediate upgrade is not feasible, consider restricting user self-registration to limit who can create accounts and submit profile images, reducing the attack surface at the cost of requiring manual user provisioning. Additionally, deploying a Content Security Policy (CSP) header that restricts script execution to trusted origins can prevent injected scripts from exfiltrating data or performing unauthorized actions, even if the XSS payload reaches the DOM. Note that CSP is a defense-in-depth measure and does not eliminate the underlying stored XSS vulnerability.