CVE-2026-109602 in Frappe
Summary
by MITRE • 10/13/2026
Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe framework, specifically affecting versions prior to 15.118.0 and version 16.x prior to 16.31.0. This vulnerability is classified as a stored cross-site scripting issue that exploits how the application handles user input within dashboard chart filter configurations. The core technical deficiency lies in the rendering mechanism of jQuery, which processes entered filter values as rich text rather than sanitizing them into plain text or escaping special characters appropriately. By failing to neutralize HTML and JavaScript content during this processing stage, the framework allows malicious scripts to be embedded directly into the stored data structures associated with dashboard filters.
This architectural oversight creates a significant security risk because it enables authenticated attackers to persistently inject executable code into the application environment. Unlike reflected cross-site scripting where payloads are delivered via URLs or temporary inputs, stored vulnerabilities allow the attacker to save the malicious payload within the database through legitimate administrative interfaces. Once saved, this content becomes part of the standard data flow whenever a dashboard chart is rendered. Consequently, any user with access rights to view these specific dashboards will inadvertently trigger the execution of the embedded scripts in their web browser context.
The operational impact of this vulnerability extends beyond simple script execution. Attackers can leverage stored cross-site scripting to perform session hijacking by stealing authentication cookies or tokens displayed within the victim's browser environment. This capability allows for unauthorized access to user accounts, potentially escalating privileges if the affected users possess administrative rights. Furthermore, attackers may use this vector to deface web pages, redirect users to malicious external sites designed for phishing attacks, or deploy additional malware payloads that exploit other vulnerabilities in the client-side software stack. The persistence of the payload means that remediation requires not only patching the framework but also purging any previously injected malicious filter values from the database.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism where input is stored in a data store and later retrieved for display without proper sanitization corresponds to CWE-80. In terms of offensive security tactics, this behavior maps directly to the MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution within web browsers. This categorization highlights the importance of input validation and output encoding as primary defense mechanisms against such injection attacks.
To mitigate this vulnerability, organizations must immediately upgrade their Frappe instances to version 15.118.0 or later for the v15 branch, or version 16.31.0 or later for the v16 branch. These updates include necessary patches that enforce strict output encoding and prevent jQuery from interpreting filter values as rich text without proper sanitization. In addition to applying vendor-supplied patches, security teams should implement a Content Security Policy header within their web server configuration to restrict inline script execution where possible. Regular audits of dashboard configurations are also recommended to detect any residual malicious filters that may have been injected prior to the patch application. Ensuring that all users interact with updated software versions is critical to eliminating this attack surface and maintaining the integrity of the data visualization layer.