EUVD-2026-38802
GHSA-x6g9-3r4x-w7cx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges required to edit the headline field; victim interaction required to trigger; scope change to victim browser with low C/I impact and no A impact.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer.
AnalysisAI
Cross-site scripting in Frappe Framework 17.0.0-dev allows a high-privileged attacker who can modify the Form Dashboard headline to inject malicious JavaScript that executes in the browsers of other users who subsequently view the affected form. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation is gated behind two significant barriers: attacker must hold high-privilege application credentials and a victim must actively navigate to the injected form. No public exploit code and no active exploitation (CISA KEV) have been identified at the time of analysis; this was reported by Fluid Attacks.
Technical ContextAI
Frappe Framework is an open-source Python full-stack web framework that powers ERPNext and other business applications. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored or reflected XSS root cause where user-controlled data is embedded in HTML output without adequate sanitization or encoding. The specific injection point is the Form Dashboard headline renderer - a UI component that displays contextual metadata atop Frappe forms. The affected product is identified via CPE cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:* (wildcard version), with the description explicitly naming version 17.0.0-dev as affected. The CVSS 4.0 scope metrics (VC:N/VI:N/VA:N with SC:L/SI:L) model the classic XSS pattern: no direct server-side impact, but low confidentiality and integrity impact on the subsequent system - the victim's browser context.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the affected version is Frappe Framework 17.0.0-dev and no fixed release version is confirmed in the available data. Organizations should monitor the Frappe GitHub repository at https://github.com/frappe/frappe for commits addressing input sanitization in the Form Dashboard headline renderer, and review the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/aterciopelados for vendor response updates. As a compensating control, restrict Form Dashboard headline editing capability to the smallest possible set of fully trusted administrators, directly reducing the attacker population enabled by the PR:H requirement. Deploying a strict Content Security Policy (CSP) header that disallows inline scripts ('script-src self') can limit XSS impact even if injection succeeds, though this may break legitimate Frappe UI functionality and should be tested in a staging environment before production rollout.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today