CVE-2026-50705

MediumCVSS 4.6

Published: 24/06/2026(UTC)Updated: 25/06/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile — higher than 17% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to update to the latest version of the Frappe framework to mitigate this vulnerability and implement appropriate XSS protection mechanisms.

Original NVD description (English source)

A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer.