Stored XSS in Frappe Framework 17.0.0-dev Notification Event Color Rendering

Stored XSS Vulnerability in Notification Event Color Rendering in Frappe Framework 17.0.0-dev Vulnerability Summary A stored cross-site scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper sanitization of user-controlled input in the Notifications > Events panel. The server-returned event data is inserted into an HTML template string and rendered using jQuery's method without proper escaping or sanitization. Affected Scope Affected Product: Frappe Framework Affected Version: 17.0.0-dev CVSS v4.0 Base Score: 4.8 (Medium) Remote Exploitability: Yes Vulnerability Type: Stored Cross-Site Scripting (XSS) Remediation No patch is currently available for this vulnerability. Proof of Concept (PoC) GUI Flow 1. Log in to the Desk as a user who can create/edit events (default Desk users have write permissions). 2. Create a live event with the status "Open" for today. 3. Set the field to the following payload: 4. Save the event. 5. Navigate to . 6. Open Notifications (bell icon) and go to the Events tab. 7. Hover over the color bar on the left side of the event ( ). Expected Result JavaScript execution ( ). API Verification (Optional) Verify that the payload reaches the source API unchanged for the current date: Evidence Exploitation Video: Video Link System Information Frappe Framework Version: 17.0.0-dev Operating System: Any References GitHub Repository: https://github.com/frappe/frappe Security: https://github.com/frappe/frappe/security Timeline Jun 4, 2026: Vulnerability Discovered Jun 5, 2026: Vendor Contacted Jun 7, 2026: Vendor Response Jun 24, 2026: Public Disclosure Credits This vulnerability was discovered by Oscar Uribe from the Offensive Team at Fluid Attacks using an AI SAST Scanner.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in Frappe Framework 17.0.0-dev Notification Event Color Rendering