Frappe Framework EUVD-2026-36460

The vulnerability exists within the Report View and List View components of Frappe. Exploitation of the stored XSS payload delivery requires that a user with sufficient Frappe permissions to create or modify reports or list view configurations submit a malicious input through those interfaces. A separate victim user must then navigate to and render the affected view for the payload to execute in their browser. Exploitation is limited by: the requirement that the injecting party have access to the Report/List View creation or editing interfaces (scope of impact depends on how broadly such permissions are granted in a given deployment); the need for a victim to visit the affected view; and the framework's permission model which can restrict who accesses specific reports. The vendor CVSS 4.0 vector asserts PR:N (no privileges required), but this should be verified against the full advisory - most Frappe deployments restrict report creation to authenticated users.

The vendor-provided CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) warrants scrutiny. A PR:N rating implies no authentication is required to inject the payload, which would be unusual for Report/List View access in most Frappe deployments - these views are typically behind authentication. The UI:N rating is also atypical for stored XSS, since a victim must load the affected page for the payload to execute; CVSS 4.0's UI:P (passive interaction) would be the conventional choice. The VI:L rating with VC:N is conservative given that XSS can realistically enable session token theft, which implies confidentiality impact. Despite these metric questions, the real-world risk is moderate: stored XSS in a business application framework with broad adoption (ERPNext ecosystem) can lead to account takeover, credential harvesting, or lateral movement within an organization. EPSS at 0.02% and no KEV listing suggest no current mass exploitation. The discrepancy between the vendor's PR:N/UI:N and typical stored-XSS exploitation mechanics should be verified against the full advisory details - the actual exploitability may require authenticated access.

An attacker with the ability to create or modify a Frappe Report or List View - potentially an authenticated low-privilege user - crafts a report name or field value containing a JavaScript payload. When any other user navigates to the affected Report or List View, the stored script executes in their browser session, enabling session cookie theft, credential harvesting via fake login prompts, or further actions on behalf of the victim. No public proof-of-concept code has been identified at time of analysis.