CVE-2026-50700: Frappe Framework Stored XSS Vulnerability

CVE-2026-50700 Overview

CVE-2026-50700 is a Stored Cross-Site Scripting (XSS) vulnerability in Frappe Framework version 17.0.0-dev. The flaw resides in the frappe.get_avatar function, which fails to properly neutralize user-controlled input before rendering it in the application interface. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browser context of other users who view the affected avatar content. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation and affects the confidentiality and integrity of subsequent user sessions.

Critical Impact
Stored XSS payloads injected through frappe.get_avatar persist in the application and execute against any authenticated user who renders the affected page, enabling session-context script execution.

Affected Products

Frappe Framework version 17.0.0-dev
Applications built on the affected Frappe Framework version that invoke frappe.get_avatar
ERPNext and downstream deployments running on the affected development branch

Discovery Timeline

2026-06-24 - CVE-2026-50700 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-50700

Vulnerability Analysis

The vulnerability stems from improper output encoding in the frappe.get_avatar helper. Frappe Framework provides this function to render user avatar markup based on stored profile attributes. When the function constructs HTML output, it includes attacker-controlled fields without applying contextual escaping. As a result, an authenticated user with the ability to modify avatar-related fields can persist arbitrary HTML and JavaScript into the data store. The payload executes whenever another user loads a view that invokes get_avatar for the affected record.

Exploitation requires high privileges and user interaction, which limits mass exploitation. However, multi-tenant Frappe deployments and ERPNext installations frequently grant avatar or profile editing rights to multiple roles, expanding the practical attack surface. The Exploit Prediction Scoring System (EPSS) currently rates exploitation likelihood low.

Root Cause

The root cause is missing or insufficient HTML entity encoding in the avatar rendering path. The frappe.get_avatar function concatenates user-supplied data into an HTML template without invoking Frappe's standard escaping utilities. This violates the framework's normal pattern of sanitizing dynamic values before they reach the DOM, allowing script tags, event handlers, or attribute-breaking payloads to render as live markup.

Attack Vector

An authenticated attacker submits a crafted payload through any input bound to the avatar rendering pipeline. The payload is stored server-side as part of the user or profile record. When a victim navigates to a page that calls frappe.get_avatar for that record, the browser parses the injected markup and executes the attacker's JavaScript under the victim's origin. The attacker can then read DOM content, issue authenticated requests, or pivot to additional in-application actions.

No verified public proof-of-concept code is available. For technical details, see the Fluid Attacks Security Advisory and the GitHub Frappe Repository.

Detection Methods for CVE-2026-50700

Indicators of Compromise

Avatar, full name, or profile fields containing HTML tags such as <script>, <img onerror=, or <svg onload=
Outbound requests from authenticated user browsers to unexpected domains immediately after viewing pages that render avatars
Audit log entries showing profile updates from accounts that subsequently trigger client-side errors for other users

Detection Strategies

Inspect Frappe database fields used by frappe.get_avatar for raw HTML or JavaScript syntax using regex queries against tabUser and related doctypes
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution originating from rendered avatars
Review web server access logs for POST requests to user profile endpoints carrying payloads containing angle brackets or event handler attributes

Monitoring Recommendations

Enable Frappe's built-in activity log and forward authentication and profile modification events to a centralized logging platform
Alert on JavaScript errors and CSP violations reported by browsers for authenticated sessions
Monitor outbound DNS and HTTP traffic from administrative workstations that routinely access the Frappe desk interface

How to Mitigate CVE-2026-50700

Immediate Actions Required

Audit all user records and related doctypes for stored HTML content in fields consumed by frappe.get_avatar and sanitize any malicious entries
Restrict profile and avatar editing permissions to the minimum set of trusted roles until a patched release is deployed
Apply Frappe's framework-level escaping helpers wherever custom code invokes frappe.get_avatar or constructs avatar markup

Patch Information

At the time of publication, the advisory identifies Frappe Framework 17.0.0-dev as affected. Track upstream remediation through the GitHub Frappe Repository and apply the official fix once released. Until a tagged release is available, organizations running development builds should pin to a known-good commit and rebuild only after verifying the avatar rendering path enforces output encoding.

Workarounds

Wrap calls to frappe.get_avatar in server-side or template-level escaping using Frappe's frappe.utils.escape_html before output
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Temporarily disable avatar rendering in custom views by overriding the template until the upstream fix is applied

bash

# Example Content Security Policy header for Frappe deployments
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";