Frappe Framework EUVD-2026-38808

Q: What is the CVSS score of EUVD-2026-38808?

EUVD-2026-38808 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-50712 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Fluid Attacks

GHSA-frfw-jgx2-wcrh

XSS Frappe Frappe Framework

4.8

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Stored XSS requires low-privilege write access to inject and victim browser interaction to trigger; scope changes to other users' sessions with low C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 15:51 vuln.today

DescriptionCVE.org

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.ui.Tree component

AnalysisAI

Stored XSS in Frappe Framework 17.0.0-dev allows authenticated low-privileged users to inject persistent malicious scripts via the frappe.ui.Tree component, which then execute in the browsers of other users who load the affected tree view. Reported by Fluid Attacks, this vulnerability carries a CVSS 4.0 score of 4.8 reflecting cross-user scope change impact despite limited direct system compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant, where attacker-supplied content is persisted to the application's data store and later rendered unsanitized in other users' browser sessions. The affected component is frappe.ui.Tree, a JavaScript UI widget within Frappe Framework - an open-source Python-based full-stack web application framework commonly powering ERPNext and similar business applications. Version 17.0.0-dev is a pre-release/development build. The CPE identifier cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:* uses a wildcard version range, indicating no upper-bound patched version has been formally confirmed in available data.

RemediationAI

No vendor-released patch with an exact fix version has been identified from available data at time of analysis; organizations should actively monitor the upstream Frappe repository at https://github.com/frappe/frappe for commits that address input sanitization in the frappe.ui.Tree component. As a compensating control, restricting write permissions on tree-rendered fields to fully trusted, high-privilege users only reduces attacker-controlled input surface - note this may constrain standard user workflows that depend on tree editing. Reviewing and enforcing a strict Content Security Policy (CSP) can reduce the blast radius of any injected script execution, though CSP alone does not prevent stored XSS and misconfiguration risks breaking legitimate Frappe UI functionality. Organizations running the 17.0.0-dev pre-release build should strongly evaluate downgrading to the latest stable Frappe release, as the development build carries inherent additional risk. Consult the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/misfits for any additional remediation guidance provided by the reporter.