CVE-2026-50703

MediumCVSS 4.8

Published: 24/06/2026(UTC)Updated: 25/06/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile — higher than 15% of all known CVEs

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to update Frappe Framework to the latest version to mitigate this vulnerability and implement appropriate XSS protection mechanisms.

Original NVD description (English source)

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer.