Executive brief
Frappe Framework is a web application framework used to build business software. A security vulnerability in the 'Auto Repeat' feature allows an attacker with administrative or write access to inject malicious scripts into the system. When other users view the affected forms, these scripts execute in their browser, potentially allowing the attacker to perform actions on their behalf or access sensitive information displayed on the page.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev within the Auto Repeat dashboard schedule rendering. The flaw is located in the 'reference_document' field, where an authenticated attacker with high privileges (write access) can persist HTML or JavaScript using a whitelisted write path. The malicious payload is triggered when other users open the affected Auto Repeat form. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack requires network reachability and user interaction from the victim, but bypasses standard input sanitization due to the use of a whitelisted path.
Affected products
- Frappe Frappe Framework 17.0.0-dev
Timeline
- 2026-06-24: disclosed: Initial disclosure by Fluid Attacks
- 2026-06-24: advisory: NVD publication date