CVE-2026-3837CWE-79
Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters
Medium · published April 22, 2026
What it is
An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping
This issue affects Frappe: 16.10.0.
The record
Technical detail
- CVSS v4.0
- 4.6 · MEDIUM
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- EPSS
- 0.00339 · 26.1th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-04-22T19:52Z
EPSS history
Timeline