Executive brief
A security vulnerability exists in the Frappe Framework, a low-code web platform used for building business applications. An attacker with basic user permissions can inject malicious scripts into tree-view components, which could lead to unauthorized actions or data theft when other users view the affected content. This impact is primarily limited to the user's browser session and the integrity of the displayed information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. The flaw is located in the frappe.ui.Tree component due to improper neutralization of user-controlled input during the rendering of tree node labels. An attacker with low-level privileges can submit a malicious payload that, when stored and subsequently viewed by another user (such as an administrator), executes arbitrary JavaScript in the context of that user's session. This can lead to session hijacking or unauthorized actions on behalf of the victim. The vulnerability is tracked as CWE-79.
Affected products
- Frappe Frappe Framework 17.0.0-dev
Timeline
- 2026-06-24: disclosed: Advisory published by Fluid Attacks
- 2026-06-24: advisory: NVD record created