What’s Vulnerable › Vulnerabilities

CVE-2026-3837: Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-22 · updated 2026-06-17
• Weakness: CWE-79

Description

An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping This issue affects Frappe: 16.10.0.

Affected products

• frappe: 16.10.0

References

• https://fluidattacks.com/es/advisories/sabina
• https://github.com/frappe/frappe
• https://github.com/frappe/frappe/pull/38796

Get alerted when CVE-2026-3837 or the next vulnerability affects your stack