CVE-2025-71430 Overview
CVE-2025-71430 is a stored cross-site scripting (XSS) vulnerability in the Frappe framework. The flaw exists in the leaderboard page, which renders user names without proper output neutralization [CWE-79]. Authenticated attackers can set a crafted user name containing JavaScript payloads. When other users view the leaderboard, the payload executes in their browsers under the application's origin. The issue affects Frappe versions before 14.99.10 and 15.x versions before 15.91.1.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the browser sessions of other Frappe users viewing the leaderboard, enabling session theft, UI manipulation, and actions performed under the victim's identity.
Affected Products
- Frappe framework versions prior to 14.99.10
- Frappe framework 15.x versions prior to 15.91.1
- Applications built on vulnerable Frappe versions that expose the leaderboard page
Discovery Timeline
- 2026-10-12 - CVE-2025-71430 published to NVD
- 2026-10-12 - Last updated in NVD database
Technical Details for CVE-2025-71430
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Frappe leaderboard component. The leaderboard renders user-controlled fields, specifically user names, directly into the HTML response. Frappe does not apply proper HTML entity encoding or sanitization before rendering these values. An authenticated attacker can update their own user profile to inject a JavaScript payload inside the full_name or equivalent display field. When another user loads the leaderboard view, their browser parses the injected markup and executes the script in the context of the Frappe application origin.
Stored XSS in a shared view amplifies impact. The payload persists in the database and fires against every visitor to the leaderboard, including administrators. Attackers can leverage this to exfiltrate session cookies, issue authenticated API requests on behalf of victims, or modify rendered content to stage follow-on social engineering.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The leaderboard template interpolates user-supplied display names without context-aware escaping, violating the output encoding requirements for HTML sinks.
Attack Vector
Exploitation requires network access to the Frappe application and a valid low-privilege authenticated account. The attacker modifies the account's user name to include an HTML or script payload. Delivery occurs passively: any user visiting the leaderboard triggers the payload. User interaction from the victim is limited to viewing the page.
No verified public proof-of-concept code is available. For technical details, refer to the GitHub Security Advisory GHSA-cx24-w5gm-5vv9 and the VulnCheck Stored XSS Advisory.
Detection Methods for CVE-2025-71430
Indicators of Compromise
- User profile records containing HTML tags, <script> elements, or javascript: URIs in the full_name or related display fields.
- Unexpected outbound requests from browser sessions after loading the /leaderboard route, especially to attacker-controlled domains.
- Audit log entries showing user name updates immediately followed by access to the leaderboard page from other accounts.
Detection Strategies
- Query the Frappe tabUser table for display name fields matching regex patterns such as <[^>]+>, on\\w+=, or javascript:.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from leaderboard pages.
- Review web server access logs for high-frequency requests to the leaderboard endpoint correlated with recent user profile changes.
Monitoring Recommendations
- Alert on modifications to user display name fields that contain HTML metacharacters.
- Monitor browser error telemetry and CSP violation reports for scripts injected on authenticated pages.
- Track Frappe version strings across deployments to confirm all instances meet the patched baseline.
How to Mitigate CVE-2025-71430
Immediate Actions Required
- Upgrade Frappe to version 14.99.10 or later for the 14.x branch, or 15.91.1 or later for the 15.x branch.
- Audit existing user records and remove or sanitize any display names containing HTML or script content.
- Invalidate active sessions for administrators who may have visited the leaderboard prior to remediation.
Patch Information
The maintainers released fixes in Frappe 14.99.10 and 15.91.1. The patches add proper output neutralization for user-supplied names rendered on the leaderboard. Refer to the GitHub Security Advisory GHSA-cx24-w5gm-5vv9 for commit references and version metadata.
Workarounds
- Restrict access to the leaderboard page via role permissions until patching is complete.
- Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins.
- Validate user name updates server-side to reject input containing HTML tags or JavaScript URI schemes.
# Upgrade Frappe to a patched release using bench
bench update --patch
bench switch-to-branch version-15 frappe --upgrade
bench pip install --upgrade frappe==15.91.1
bench migrate
bench restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
