CVE-2026-50708: Frappe Framework Stored XSS Vulnerability

CVE-2026-50708 Overview

CVE-2026-50708 is a Stored Cross-Site Scripting (XSS) vulnerability in Frappe Framework version 17.0.0-dev. The flaw resides in the MultiSelectDialog component, which fails to properly neutralize user-controlled input before rendering it in the browser. An authenticated attacker can inject malicious JavaScript payloads that persist in the application and execute in the context of other users' sessions. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can store malicious scripts that execute in victim browsers, enabling session theft, UI manipulation, and unauthorized actions in the Frappe application context.

Affected Products

Frappe Framework version 17.0.0-dev
MultiSelectDialog component within Frappe
Applications built on the vulnerable Frappe release (including ERPNext deployments using the affected build)

Discovery Timeline

2026-06-24 - CVE-2026-50708 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-50708

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-controlled input within the MultiSelectDialog component of Frappe Framework. When a user submits crafted content through fields rendered by this dialog, the framework stores the payload and later returns it to other users without sufficient output encoding. The stored payload executes as JavaScript in the victim's browser session.

Exploitation requires low-privilege authentication and user interaction, since a victim must view the page that renders the stored content. The attack vector is network-based and exploitable through standard HTTP requests against the Frappe web interface. Successful exploitation does not directly compromise the underlying vulnerable system but affects subsequent components — primarily the integrity and confidentiality of the victim's browser session.

See the Fluid Attacks Security Advisory for additional technical details.

Root Cause

The root cause is missing or insufficient output encoding in the MultiSelectDialog rendering path. User-supplied values are concatenated into HTML output without context-aware escaping, allowing <script> tags and event-handler attributes to be interpreted as executable code by the browser.

Attack Vector

An authenticated attacker injects a JavaScript payload into a field handled by MultiSelectDialog. The payload is persisted in the backend datastore. When another authenticated user opens a view that invokes the vulnerable dialog, the stored payload renders inline and executes under the origin of the Frappe application, granting the attacker access to cookies, CSRF tokens, and authenticated API operations available to the victim.

No verified public proof-of-concept code is available. The mechanism is described in prose; consult the Fluid Attacks advisory and the Frappe GitHub repository for the affected code paths.

Detection Methods for CVE-2026-50708

Indicators of Compromise

Stored field values containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs in records consumed by MultiSelectDialog.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after loading Frappe pages.
Session token or API key access patterns that originate from unusual user-agent strings or IP addresses shortly after a victim views a dialog.

Detection Strategies

Audit Frappe DocType records for HTML and JavaScript artifacts in text fields rendered by the MultiSelectDialog component.
Deploy Content Security Policy (CSP) reporting to surface inline-script execution attempts originating from Frappe pages.
Review web server and application logs for POST requests containing encoded <script> or event-handler payloads targeting form save endpoints.

Monitoring Recommendations

Enable verbose audit logging on Frappe document creation and update operations to capture the originator of suspicious payloads.
Monitor browser-side error and CSP violation telemetry from authenticated user sessions.
Alert on administrative or privileged account sessions that follow shortly after loading list views or selection dialogs.

How to Mitigate CVE-2026-50708

Immediate Actions Required

Restrict access to the Frappe 17.0.0-dev instance to trusted users only until a fixed version is deployed.
Inventory and sanitize existing records whose fields are rendered by MultiSelectDialog to remove stored HTML payloads.
Rotate session secrets and API keys if evidence of stored payload execution is found.

Patch Information

No fixed version is referenced in the published NVD record at the time of writing. Track the Frappe GitHub repository for commits that address MultiSelectDialog output encoding and upgrade as soon as a patched release is published. The version identified as affected is 17.0.0-dev.

Workarounds

Implement a strict Content Security Policy that disallows unsafe-inline scripts on Frappe application origins.
Apply a reverse-proxy or WAF rule that blocks request bodies containing HTML tags or event-handler attributes in form fields tied to MultiSelectDialog.
Limit account privileges so that lower-trust users cannot persist data into fields consumed by privileged users' dialogs.

bash

# Example CSP header to mitigate inline script execution on Frappe origins
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;