CVE-2026-50698
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk17th percentile — higher than 17% of all known CVEs
Summary
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component.
Risk Assessment
This vulnerability may allow malicious code execution in users' browsers, posing a threat to data security and application integrity.
Recommendation
It is recommended to update Frappe Framework to the latest version that addresses this vulnerability and to review the code to ensure proper input validation.
Original NVD description (English source)
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component.