EUVD-2026-38799
GHSA-xp83-3qxw-8rm6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low privilege to write payload, victim interaction required; scope changes as script executes in other users' browser context with low C/I impact.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer.
AnalysisAI
Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows an authenticated low-privileged user to inject persistent malicious scripts via the Desk desktop icon renderer, which then execute in the browsers of other users - including administrators - who subsequently view the affected Desk interface. The vulnerability was reported by Fluid Attacks and carries a CVSS 4.0 score of 4.8 (Medium), reflecting cross-user impact limited to the subsequent-system scope (SC:L/SI:L). No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Frappe Framework is a Python/JavaScript full-stack web framework primarily known as the foundation for ERPNext, a widely-used open-source ERP platform. The Desk component serves as the primary user interface and displays desktop icons representing application shortcuts. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant: user-controlled input submitted into icon properties (such as label or name) is persisted to the backend database without adequate sanitization and later rendered in the DOM without proper output encoding. The affected CPE (cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:*) uses a wildcard version, indicating NVD has not precisely bounded the affected range beyond the reported 17.0.0-dev build.
RemediationAI
Upstream fix availability has not been confirmed - no patched release version is cited in the available data, and the GitHub reference (https://github.com/frappe/frappe) does not point to a specific commit or tagged release resolving this issue. Organizations should monitor the Frappe GitHub repository and the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/soja for patch availability. As compensating controls pending a patch: restrict the ability to create or modify Desk desktop icons to trusted administrator roles, reducing the PR:L attack surface to PR:H in practice; enforce a strict Content Security Policy (CSP) header that disallows inline script execution, which would significantly reduce the impact of any XSS payload even if injected; and audit existing custom desktop icons for unexpected or suspicious content. Disabling custom icon creation entirely is the most effective workaround but may disrupt normal user workflows.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today