Vulnerability Report

CVE-2026-3837

Title: Frappe client-side script execution (XSS)

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2026-3837.

CWE Category CWE-79

Published Date Apr 22, 2026

Modified Date May 14, 2026

Exploit Status Not Found

Score 4.6 CVSS v4.0

Exploit Probability (EPSS)

0.19%

Vulnerability Summary

CVE-2026-3837: An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping This issue affects Frappe: 16.10.0.

Impacted Vendors

frappe 1

Reference Links

https://fluidattacks.com/es/advisories/sabina https://github.com/frappe/frappe

CVSS v4.0

Source Entity [email protected]

Severity MEDIUM

4.6

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

ACTIVE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

5.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns