Executive brief
Frappe Framework, a low-code web framework used for business applications, is vulnerable to a security flaw in its desktop interface. An attacker with low-level user permissions can inject malicious scripts into desktop icon labels. If another user views these icons, the script could execute in their browser, potentially leading to unauthorized actions or information disclosure within the application.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the Frappe Framework (specifically version 17.0.0-dev). The flaw resides in the 'Desk' desktop icon renderer, which fails to properly neutralize or escape user-controlled input when rendering icon labels. An attacker with 'Low' privileges (PR:L) can inject malicious JavaScript into an icon label. When an administrative or targeted user interacts with or views the affected desktop icon (UI:A), the payload executes in the context of their session. This can allow for the exfiltration of session tokens or the performance of unauthorized actions on behalf of the victim.
Affected products
- Frappe Frappe Framework 17.0.0-dev
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory