Frappe Framework EUVD-2026-38807

Q: What is the CVSS score of EUVD-2026-38807?

EUVD-2026-38807 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-50711 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Fluid Attacks

GHSA-g23q-hh57-9ww7

XSS Frappe Frappe Framework

4.6

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Admin privileges required to store the payload (PR:H), victim must load the page (UI:R), and stored XSS changes scope to affect other users' sessions (S:C) with limited confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 15:52 vuln.today

DescriptionCVE.org

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component.

AnalysisAI

Stored Cross-Site Scripting in Frappe Framework 17.0.0-dev allows a high-privileged authenticated user to inject persistent malicious scripts into the Number Card dashboard component, which then execute in the browsers of other users who view the affected dashboard. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation requires admin-level access to plant the payload and a victim's browser interaction to trigger it, limiting realistic blast radius despite the network delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Frappe Framework is an open-source, full-stack Python and JavaScript web application framework that underpins ERPNext and other business applications. The Number Card is a configurable dashboard widget that renders aggregated data. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled input accepted during card configuration is stored without adequate sanitization and later rendered as live HTML/JavaScript in other users' browser sessions. The CPE string cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:* covers all sub-versions of the framework, though the specific affected release is the 17.0.0-dev development branch. The stored (persistent) variant of XSS is more severe than reflected XSS because the payload survives across sessions without requiring per-victim phishing.

RemediationAI

No vendor-released patch version has been identified in the available data. Organizations should monitor the upstream repository at https://github.com/frappe/frappe for a fix commit or tagged release addressing this component, and review the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/disturbed for any coordinated disclosure timeline. As a compensating control, restrict the ability to create or modify Number Card configurations to the minimum necessary set of trusted administrators, reducing the pool of accounts capable of planting a payload. Additionally, enforcing a strict Content Security Policy (CSP) header that blocks inline script execution can prevent XSS payloads from running even if stored, though this may require testing for compatibility with Frappe's own JavaScript-heavy interface. Avoid running the 17.0.0-dev development branch in production environments until a patched release is available.