Is CVE-2026-3673 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3673 being exploited in the wild.

How severe is CVE-2026-3673?

Medium severity, with a CVSS score of 5.4, published 22 April 2026.

Which products and versions are affected?

Frappe Technologies Frappe Framework 16.10.10.

Is there a fix for CVE-2026-3673?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3673 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3673?

Check whether you run Frappe or Frappe Technologies Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3673: Frappe Framework stored XSS in Tag Pill Renderer

CVE-2026-3673 · Severity: medium · CVSS 5.4 · Published 2026-04-22

Frappe Framework, a low-code web platform used for building business applications, contains a security flaw in how it handles user-defined tags. An authenticated user can save a malicious tag that, when viewed by another user in a report or list, executes unauthorized code in their browser. This could allow an attacker to perform actions on behalf of other users or access sensitive information within the application.

Technologies: Frappe, Frappe Technologies Frappe Framework. Vendors: Frappe, Frappe Technologies.

Quick answers

Is CVE-2026-3673 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3673 being exploited in the wild.
How severe is CVE-2026-3673?: Medium severity, with a CVSS score of 5.4, published 22 April 2026.
Which products and versions are affected?: Frappe Technologies Frappe Framework 16.10.10.
Is there a fix for CVE-2026-3673?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3673 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3673?: Check whether you run Frappe or Frappe Technologies Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 16.10.10. The vulnerability is located in the Tag Pill Renderer, specifically within the '_user_tags' component. The root cause is the improper neutralization of input during web page generation (CWE-79), where the renderer interpolates tag content into HTML attributes and element content without sufficient escaping. An authenticated attacker with low privileges can store a malicious payload in a tag; when an administrative user or another victim views a list or report containing that tag, the payload executes in the context of their session. This can lead to session hijacking or unauthorized data modification.

Affected products

Frappe Frappe Framework 16.10.10

Timeline

2026-04-22: disclosed: Initial disclosure by Fluid Attacks
2026-04-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.