Executive brief
Frappe Framework, a low-code web framework used for building business applications, is vulnerable to a security flaw in its notification system. An attacker with basic user permissions can inject malicious scripts into the 'Events' panel. If an administrator or another user views these notifications, the script could execute in their browser, potentially allowing the attacker to perform unauthorized actions or access sensitive information within the application session.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. The flaw is located in the Notifications > Events panel, where event data returned from the server is interpolated into an HTML template string and rendered using jQuery's .html() method without adequate escaping or sanitization. An attacker with low-level privileges (PR:L) can craft a malicious event that, when viewed by another user (UI:A), executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking or unauthorized data modification within the web application.
Affected products
- Frappe Frappe Framework 17.0.0-dev
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory