PT-2026-34557 · Frappe · Frappe

Oscar Uribe · Published 2026-04-22 · Updated 2026-05-14 · CVE-2026-3837

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frappe version 16.10.0

Description An authenticated attacker can persist crafted values in multiple field types to trigger client-side script execution when another user opens the affected document in Desk. This occurs because vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without proper escaping.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3837

Affected Products

Frappe

References · 7

• 🔥 https://fluidattacks.com/es/advisories/sabina · Exploit
• https://github.com/frappe/frappe/pull/38796 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3837 · Security Note
• https://github.com/frappe/frappe · Note
• https://twitter.com/fluidattacks/status/2047439370974588967 · Twitter Post
• https://twitter.com/CVEnew/status/2047359953644466475 · Twitter Post
• https://t.me/cveNotify/163525 · Telegram Post