CVE-2026-50712: Frappe Framework Stored XSS Vulnerability

CVE-2026-50712 Overview

CVE-2026-50712 is a Stored Cross-Site Scripting (XSS) vulnerability in Frappe Framework version 17.0.0-dev. The flaw resides in the frappe.ui.Tree component, which fails to properly neutralize user-controlled input before rendering it in the browser. An authenticated attacker with low privileges can inject malicious JavaScript that executes in the context of other users who view the affected tree view. The weakness is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can persist JavaScript payloads in Frappe tree nodes, executing arbitrary script in victim browsers and enabling session abuse, UI redressing, and data exfiltration within the application context.

Affected Products

Frappe Framework 17.0.0-dev
Applications built on the affected Frappe Framework version that expose the frappe.ui.Tree component
Downstream products including ERPNext deployments using the vulnerable development branch

Discovery Timeline

2026-06-24 - CVE CVE-2026-50712 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-50712

Vulnerability Analysis

The vulnerability stems from improper output encoding in the frappe.ui.Tree JavaScript component. Tree nodes accept user-controlled labels and metadata that are persisted server-side. When the component renders these values into the Document Object Model (DOM), it does not apply contextual HTML encoding. As a result, script tags or event handler attributes supplied by an attacker survive storage and execute when another user loads the tree view.

This is a stored XSS pattern, meaning the payload persists in the application database and triggers automatically for every viewer of the affected tree. Exploitation requires low privileges and a user interaction step, since a victim must navigate to the page rendering the malicious node. The scope reaches beyond the attacker's account because the script executes within the victim's authenticated session.

Root Cause

The frappe.ui.Tree component concatenates user-supplied node content directly into HTML without invoking a sanitization routine such as frappe.utils.escape_html or an equivalent DOM-safe API. Trust is incorrectly placed on input that authenticated users can submit through standard Frappe forms and API endpoints.

Attack Vector

An attacker with a low-privilege Frappe account creates or edits a record that feeds into a tree view, embedding a JavaScript payload inside a node label or description. When an administrator or another user opens the document that renders the tree, the injected script executes in their browser. Practical impact includes theft of sid session cookies, forced API calls under the victim's identity, and modification of arbitrary DocTypes accessible to the victim.

No verified public exploit code is available. Refer to the Fluid Attacks Security Advisory and the GitHub Frappe Repository for additional technical context.

Detection Methods for CVE-2026-50712

Indicators of Compromise

Tree node labels, titles, or description fields containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...>.
Unexpected outbound requests from authenticated browser sessions to attacker-controlled domains shortly after loading tree views.
Frappe audit log entries showing DocType updates to fields rendered by frappe.ui.Tree from low-privilege accounts.

Detection Strategies

Query the Frappe database for stored field values matching regular expressions for HTML or JavaScript syntax in DocTypes that back tree views.
Deploy Content Security Policy (CSP) reporting endpoints and monitor script-src violations originating from Frappe application paths.
Review web server access logs for anomalous POST requests to /api/method/frappe.client.set_value containing encoded angle brackets in payloads.

Monitoring Recommendations

Alert on browser console errors and CSP violation reports tied to Frappe URLs.
Track session activity for privileged users to identify API calls that do not match their normal workflow, indicating script-driven abuse.
Monitor creation and modification events on DocTypes consumed by tree components for input that contains markup characters.

How to Mitigate CVE-2026-50712

Immediate Actions Required

Avoid deploying Frappe Framework 17.0.0-dev in production environments and restrict access to non-production instances.
Audit existing tree-backed DocTypes for stored payloads and sanitize or remove suspicious entries.
Restrict permissions on DocTypes feeding tree views so only trusted roles can create or edit nodes.

Patch Information

No fixed version is referenced in the NVD entry at publication time. Monitor the GitHub Frappe Repository for commits addressing the frappe.ui.Tree rendering path and upgrade to a stable release that supersedes the 17.0.0-dev branch once available.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script-src origins to neutralize injected payloads.
Apply server-side input validation that rejects markup characters in fields consumed by tree components.
Wrap calls into frappe.ui.Tree with a custom rendering helper that applies HTML entity encoding before insertion into the DOM.

bash

# Configuration example: enforce a restrictive CSP for the Frappe site
# Add to nginx site configuration serving the Frappe application
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report" always;