Executive brief
Frappe, a web framework used for business applications, is vulnerable to a security flaw where an attacker can inject malicious scripts into document fields. When another user views the affected document, the script executes in their browser, potentially allowing the attacker to steal session information or perform actions on the user's behalf. This risk is particularly relevant for organizations using Frappe-based tools like ERPNext for internal operations.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 16.10.0. The issue stems from improper neutralization of input during web page generation, specifically within formatter implementations for 'icon' and 'color' field types. These formatters interpolate stored values into raw HTML attributes and element content without adequate escaping. An authenticated attacker can persist crafted payloads in these fields; when a victim (such as an administrator) opens the affected document in the Desk interface, the payload executes. This can lead to session hijacking or unauthorized actions within the application. A patch has been developed to escape these fields.
Affected products
- Frappe Frappe Framework 16.10.0
Timeline
- 2026-04-22: disclosed
- 2026-04-22: patched: Fix merged in GitHub pull request 38796
- 2026-04-22: advisory