CVE-2026-50700

MediumCVSS 4.6

Published: 24/06/2026(UTC)Updated: 25/06/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile — higher than 17% of all known CVEs

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function.

Risk Assessment

This vulnerability may allow for the execution of malicious code in the user's browser context, posing a threat to data security and user privacy.

Recommendation

It is recommended to update Frappe Framework to the latest version to mitigate this vulnerability and implement proper input validation mechanisms.

Original NVD description (English source)

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function.