Executive brief
Frappe Framework, a low-code web framework used for business applications, contains a security vulnerability in its dashboard rendering component. An attacker with high-level administrative privileges can inject malicious scripts that execute in the browsers of other users when they view specific dashboard headlines. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in the Form Dashboard headline renderer of Frappe Framework version 17.0.0-dev. The root cause is the improper neutralization of untrusted input before it is rendered in the dashboard UI. An attacker with high privileges (PR:H) can inject malicious JavaScript into the headline field. The exploit requires a victim to interact with the affected dashboard page (UI:A). Successful exploitation allows the execution of arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure or session hijacking.
Affected products
- Frappe Frappe Framework 17.0.0-dev
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory