CVE-2026-50710: Frappe Framework Stored XSS Vulnerability

CVE-2026-50710 Overview

CVE-2026-50710 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Frappe Framework version 17.0.0-dev. The flaw resides in the Number Card component, which performs unsafe evaluation of user-controlled data. An authenticated attacker with elevated privileges can persist malicious JavaScript that executes in the browser of any user who later renders the affected dashboard element. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can store JavaScript payloads in Number Card configurations, leading to session-context script execution against other Frappe users when those cards are rendered.

Affected Products

Frappe Framework 17.0.0-dev
Number Card component within the Frappe dashboard subsystem
Deployments running the affected development branch from the GitHub Frappe Repository

Discovery Timeline

2026-06-24 - CVE-2026-50710 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-50710

Vulnerability Analysis

The vulnerability stems from the Number Card component evaluating user-supplied data without proper sanitization or contextual output encoding. Number Cards in Frappe display aggregated metrics on dashboards and accept configuration values such as labels, filters, and dynamic expressions. When these values include HTML or JavaScript fragments, the framework processes them in a way that allows the markup to reach the rendered DOM unescaped.

Because the malicious content is persisted in the database, the payload triggers every time a victim loads the dashboard containing the card. The attacker requires high privileges to create or modify the Number Card, so exploitation depends on either an existing privileged account or a separate privilege-escalation path. User interaction is required, since the victim must visit the affected dashboard.

For additional context, see the Fluid Attacks Advisory.

Root Cause

The root cause is unsafe evaluation of user-controlled data inside the Number Card rendering logic. Input that should be treated as inert text is instead interpreted in a JavaScript or HTML context, violating the principle of contextual output encoding required to prevent [CWE-79].

Attack Vector

The attack vector is network-based and exploited through the Frappe web interface. A privileged user submits a Number Card definition containing a script payload. When another user opens the dashboard, the browser parses and executes the stored payload under the victim's session origin, enabling actions such as cookie theft, UI redress, or API calls on behalf of the victim.

No verified exploit code is publicly available. The vulnerability mechanism is described in prose because no proof-of-concept has been confirmed in trusted sources.

Detection Methods for CVE-2026-50710

Indicators of Compromise

Number Card documents containing <script> tags, javascript: URIs, or event handler attributes such as onerror= or onload=
Unexpected outbound HTTP requests from authenticated user browsers shortly after loading dashboards
Audit log entries showing Number Card creation or modification by accounts that do not normally manage dashboards

Detection Strategies

Query the Frappe database for Number Card records and scan label, filter, and expression fields for HTML or JavaScript syntax
Inspect browser Content Security Policy (CSP) violation reports for inline script execution originating from dashboard routes
Review web server access logs for repeated dashboard loads following Number Card edits by privileged accounts

Monitoring Recommendations

Enable and centralize Frappe application audit logs covering document create, update, and delete events on the Number Card doctype
Monitor authentication logs for privileged accounts that perform Number Card modifications outside normal change windows
Forward browser CSP report-uri data to a SIEM for correlation with user sessions and dashboard access

How to Mitigate CVE-2026-50710

Immediate Actions Required

Restrict the System Manager and other roles permitted to create or edit Number Cards to a minimal set of trusted administrators
Audit all existing Number Card records for embedded HTML, script tags, or event handler attributes and remove unsafe content
Deploy a strict Content Security Policy that disallows inline scripts on Frappe dashboard pages

Patch Information

At the time of publication, no fixed version is enumerated in the NVD entry for CVE-2026-50710. The affected build is identified as 17.0.0-dev. Track upstream commits and releases on the GitHub Frappe Repository and apply the vendor-supplied fix as soon as it is published. Review the Fluid Attacks Advisory for additional remediation guidance.

Workarounds

Limit access to the Number Card doctype through Frappe role permissions until a patched release is available
Disable or remove untrusted Number Cards from production dashboards
Enforce a CSP header such as Content-Security-Policy: default-src 'self'; script-src 'self' to block inline script execution
Require code review for any Number Card configuration changes pushed to production environments

bash

# Configuration example: enforce CSP at the reverse proxy (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;