Executive brief
Frappe Framework is a low-code web framework used to build business applications. A security vulnerability in the avatar rendering component allows an attacker with high-level privileges to inject malicious scripts into the platform. If another user views the affected profile or avatar, the script could execute in their browser, potentially leading to unauthorized actions or data access within the application session.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability was identified in Frappe Framework version 17.0.0-dev. The flaw is located in the 'frappe.get_avatar' function, which fails to properly neutralize user-supplied input during image rendering. An attacker with high privileges (PR:H) can exploit this by injecting a malicious payload into avatar-related fields. When an administrative user or another victim interacts with the rendered avatar, the payload executes in the context of their session. This is tracked as CWE-79 and was discovered by Fluid Attacks.
Affected products
- Frappe Frappe Framework 17.0.0-dev
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory