Executive brief
Frappe Framework, a low-code web platform used for building business applications, contains a security flaw in how it handles user-defined tags. An authenticated user can save a malicious tag that, when viewed by another user in a report or list, executes unauthorized code in their browser. This could allow an attacker to perform actions on behalf of other users or access sensitive information within the application.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 16.10.10. The vulnerability is located in the Tag Pill Renderer, specifically within the '_user_tags' component. The root cause is the improper neutralization of input during web page generation (CWE-79), where the renderer interpolates tag content into HTML attributes and element content without sufficient escaping. An authenticated attacker with low privileges can store a malicious payload in a tag; when an administrative user or another victim views a list or report containing that tag, the payload executes in the context of their session. This can lead to session hijacking or unauthorized data modification.
Affected products
- Frappe Frappe Framework 16.10.10
Timeline
- 2026-04-22: disclosed: Initial disclosure by Fluid Attacks
- 2026-04-22: advisory: NVD publication date