Description

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore_xss_filter": 1 in frappe/desk/doctype/workspace_link/workspace_link.json, and _sanitize_content() in frappe/model/base_document.py skips any field carrying that flag, so the value is stored exactly as submitted. frappe.desk.desktop.get_desktop_page returns it unchanged, and LinksWidget.set_body() in frappe/public/js/frappe/widgets/links_widget.js interpolates it into a Bootstrap popover created with html: true, by way of the __() translation helper, which performs no HTML escaping. A user holding the Workspace Manager role can therefore place arbitrary markup in a public workspace's card description and have it execute in the session of any desk user who opens that workspace and hovers the description, including higher-privileged users, allowing session token theft and authenticated requests as the victim. The flag is removed on the development branch but remains present in the shipped 15.x and 16.x release lines, so no released version carries the fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-27T20:18:55.640Z",
  "pubdate": "2026-08-27T20:18:55.640Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists in the Frappe framework, specifically within the workspace card description feature. This vulnerability allows an authenticated user with the 'Workspace Manager' role to inject arbitrary malicious scripts into public workspace cards.\nThe flaw arises because the system explicitly disables XSS filtering for the 'description' field within the 'Workspace Link' doctype. Consequently, the application renders unsanitized HTML and JavaScript directly into the document object model (DOM) of other users' sessions.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the affected platform. An attacker can leverage this access to execute arbitrary JavaScript in the context of any desk user—including high-privileged administrators—who interacts with the compromised workspace. The potential impact includes unauthorized authenticated requests, session token theft, and complete account takeover, effectively circumventing standard security perimeters within the application environment.",
  "technicalDetails": "The root cause of this vulnerability is the explicit bypass of security sanitization mechanisms within the Frappe framework. The 'description' field of the 'Workspace Link' doctype is defined with the 'ignore_xss_filter': 1 flag in 'frappe/desk/doctype/workspace_link/workspace_link.json'. This configuration instructs the 'frappe/model/base_document.py' backend function '_sanitize_content()' to bypass all validation and filtering logic for the input field, allowing raw, malicious payloads to be stored directly in the database.\nThe attack flow follows a predictable sequence: First, a user assigned the 'Workspace Manager' role creates or edits a public workspace card. In the 'description' field, the attacker inserts a crafted payload containing malicious JavaScript encapsulated in HTML tags (e.g., <img src=x onerror=alert(1)> or script tags). Because the backend ignores XSS filtering, this payload is stored verbatim.\nWhen a legitimate desk user navigates to the affected workspace and hovers over the compromised card, the 'frappe.desk.desktop.get_desktop_page' function retrieves the tainted data from the server. This data is subsequently passed to 'LinksWidget.set_body()' in 'frappe/public/js/frappe/widgets/links_widget.js'.\nWithin the 'set_body()' function, the payload is interpolated into a Bootstrap popover initialized with 'html: true'. Because the content is processed through the '__()' translation helper without any accompanying HTML escaping or sanitization, the browser renders the attacker-supplied markup. The JavaScript execution triggers immediately upon the user interaction (hovering), operating within the victim's session context.\nThis vulnerability affects Frappe versions 15.11.0 through 16.32.0. The exploit requires an attacker to possess the 'Workspace Manager' role to initially stage the payload. However, since the payload is stored on a public workspace, the exploitation does not require further interaction from the attacker; the vulnerability is triggered by the victim's interaction with the workspace. The resulting post-exploitation impact allows for arbitrary client-side code execution, enabling the attacker to steal sensitive session cookies, perform unauthorized API requests under the victim's identity, or modify application state without the victim's knowledge."
}