CVE-2026-50710

MediumCVSS 4.6

Published: 24/06/2026(UTC)Updated: 25/06/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile — higher than 17% of all known CVEs

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component.

Risk Assessment

This vulnerability may allow attackers to inject malicious JavaScript code, leading to user data theft or session hijacking.

Recommendation

It is recommended to update Frappe Framework to the latest version to mitigate this vulnerability and to review and validate user input data.

Original NVD description (English source)

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component.