Executive brief
Frappe Framework, a low-code web framework used for building business applications, contains a security vulnerability in its Number Card component. An attacker with high-level administrative privileges can inject malicious scripts that execute in the browsers of other users. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. The flaw is located in the Number Card component, specifically within the 'filters_config' parameter, where user-controlled data is unsafely processed using an 'eval' function. A remote attacker with high privileges (PR:H) can exploit this by injecting a malicious payload that is stored on the server. When other users, particularly those with administrative access, view the affected Number Card, the script executes in their browser context. This can result in session hijacking or unauthorized data modification.
Affected products
- Frappe Frappe Framework 17.0.0-dev
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory