CVE-2026-50711: Frappe Framework Stored XSS Vulnerability

CVE-2026-50711 Overview

CVE-2026-50711 is a Stored Cross-Site Scripting (XSS) vulnerability in Frappe Framework version 17.0.0-dev. The flaw resides in the Number Card component, which fails to properly neutralize user-controlled input before rendering it in the browser. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of any user who subsequently views the affected dashboard element. This issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored JavaScript payloads execute in victim browsers, enabling session manipulation, UI redress, and limited data exposure across the Frappe administrative interface.

Affected Products

Frappe Framework 17.0.0-dev
Frappe-based applications using the Number Card component
Web dashboards consuming Number Card output

Discovery Timeline

2026-06-24 - CVE-2026-50711 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-50711

Vulnerability Analysis

The Number Card component in Frappe Framework renders aggregated numeric values along with user-supplied metadata such as labels, titles, and formatting strings. The component does not apply HTML or JavaScript context-aware encoding to these fields before injecting them into the DOM. An attacker who can create or modify a Number Card stores a malicious payload directly in the database. When other users load a dashboard or report containing the card, the framework retrieves and renders the payload as live markup.

Exploitation requires high-level privileges to author dashboard content, and the victim must view the affected page. The resulting script runs under the same origin as the Frappe application, allowing the attacker to interact with the application as the victim within the limits of the browser session. The CWE-79 classification reflects standard stored XSS semantics where persistence amplifies reach across all users of the compromised dashboard.

Root Cause

The root cause is improper neutralization of user-controlled input. Field values stored through the Number Card configuration are written verbatim and later rendered without contextual output encoding. The framework relies on implicit trust of authenticated dashboard authors instead of treating all stored values as untrusted before HTML insertion.

Attack Vector

The attack vector is network-based and requires authenticated access with elevated privileges plus user interaction by the victim. The attacker creates or edits a Number Card, embeds a JavaScript payload in a vulnerable field, and waits for another user to load the dashboard. Refer to the Fluid Attacks Security Advisory and the GitHub Frappe Repository for further technical context. No verified proof-of-concept code is published; the vulnerability mechanism is described in prose only.

Detection Methods for CVE-2026-50711

Indicators of Compromise

Number Card records whose label, title, or formatter fields contain <script>, onerror=, onload=, or javascript: substrings.
Unexpected outbound requests from authenticated browser sessions to attacker-controlled domains shortly after dashboard loads.
Audit log entries showing Number Card creation or modification by accounts that do not normally author dashboards.

Detection Strategies

Query the Frappe database for stored Number Card fields containing HTML tags or event handler attributes.
Inspect Content Security Policy (CSP) violation reports for inline script execution originating from dashboard routes.
Review web access logs for repeated GET requests to dashboard or Number Card endpoints followed by anomalous XHR activity.

Monitoring Recommendations

Enable verbose audit logging for doctype changes affecting Number Card and related dashboard objects.
Forward Frappe application logs and browser CSP reports to a central analytics platform for correlation.
Alert on privilege changes that grant dashboard authoring rights to non-administrative roles.

How to Mitigate CVE-2026-50711

Immediate Actions Required

Restrict Number Card authoring permissions to a small set of trusted administrators until a patched build is deployed.
Audit existing Number Card entries for embedded HTML or script content and remove suspicious records.
Enforce a strict Content Security Policy that disallows inline scripts on Frappe dashboard routes.

Patch Information

No fixed version is referenced in the published NVD entry at the time of writing. Monitor the GitHub Frappe Repository for commits addressing Number Card output encoding and upgrade away from the 17.0.0-dev development branch once a stable release is published. Consult the Fluid Attacks Security Advisory for vendor coordination updates.

Workarounds

Disable the Number Card component on production dashboards until a patched release is available.
Apply server-side input validation that rejects angle brackets and event handler syntax in card metadata fields.
Deploy a web application firewall rule that blocks XSS payload patterns in requests targeting Number Card API endpoints.

bash

# Example CSP header to limit stored XSS impact on Frappe dashboards
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";