EUVD-2026-38798
GHSA-wm3j-m9vm-h95g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS requires victim to click a link (UI:R), crosses into browser scope (S:C), and has low confidentiality and integrity impact; no server availability or confidentiality breach.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component.
AnalysisAI
Reflected Cross-Site Scripting in Frappe Framework 17.0.0-dev's dashboard-view component allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms no authentication is required from the attacker, though victim interaction is mandatory. Impact is confined to the subsequent system (victim browser session), with low integrity and confidentiality consequences; no active exploitation or public POC has been identified at time of analysis.
Technical ContextAI
Frappe is an open-source full-stack Python and JavaScript web framework (https://github.com/frappe/frappe) that serves as the foundation for ERPNext and several other business applications. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the dashboard-view component reflects attacker-controlled input back to the browser without adequate sanitization or output encoding, allowing script injection. The CVSS 4.0 subsequent-system impact metrics (SC:L, SI:L) are consistent with classic reflected XSS behavior, where the vulnerable server itself is not compromised (VC:N/VI:N/VA:N), but the victim's browser session is affected. The CPE string cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:* uses a wildcard version, indicating NVD has not formally bounded the affected range beyond the explicitly named 17.0.0-dev build.
RemediationAI
No specific patched version has been identified in the available data - the input references only the Frappe GitHub repository (https://github.com/frappe/frappe) and the Fluid Attacks advisory (https://fluidattacks.com/es/advisories/nena), without citing an exact fix release. Monitor both sources for a patched build and upgrade once available. As interim compensating controls: implement a Content Security Policy (CSP) header with script-src 'self' to block inline script execution, substantially reducing XSS impact even if the reflective flaw is triggered, though this may require testing for compatibility with Frappe's own JavaScript. Deploying a WAF with XSS signature rules on the dashboard-view endpoint can detect and block crafted payloads, though obfuscated payloads may bypass rule-based filters. Restricting access to the dashboard-view component to authenticated users only (if operationally feasible) would raise the bar from PR:N to PR:L or higher, meaningfully reducing exploitation surface.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today