Executive brief
Frappe is a web application framework used to build business software. A security flaw in the 'Note' component allowed malicious scripts to be saved and later executed in the browsers of other users. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Frappe Framework's 'Note' feature. The root cause is a lack of proper input sanitization before storing user-supplied data in the database. An attacker can inject malicious JavaScript into a note; when this note is rendered for other users, the script executes within their browser context. This can be exploited to perform unauthorized actions or hijack user sessions. The vulnerability is addressed in versions 15.106.0 and 16.16.0 by implementing appropriate sanitization routines.
Affected products
- Frappe Frappe Framework < 15.106.0, < 16.16.0
Timeline
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD