Frappe Framework 17.0.0-dev Stored XSS via eval in Number Card (CVE-2026-50710)

Vulnerability Overview Vulnerability Name: Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Vulnerability Description: In Frappe Framework version 17.0.0-dev, there is a stored cross-site scripting (XSS) vulnerability located in the Number Card component, caused by unsafe evaluation of user-controllable data. An authenticated attacker can create or modify a Number Card and store a malicious payload in the field. When other users open the affected Number Card, client-side code evaluates the stored value using , resulting in the execution of arbitrary JavaScript code in the victim's browser. CVSS Score: 4.6 (Medium) CVE ID: CVE-2026-50710 Affected Scope Affected Product: Frappe Framework Affected Versions: 17.0.0-dev Remotely Exploitable: Yes Vulnerability Discoverer: Oscar Uribe (Fluid Attacks AI SAST Scanner) Remediation Current Status: No patches are currently available. Recommendation: Wait for the official patch or implement temporary mitigation measures, such as restricting access to the Number Card component and avoiding the execution of untrusted data. POC Code Evidence Video Evidence: Video containing the exploitation process. Static Evidence: Screenshots containing the exploitation process. Timeline June 4, 2026: Vulnerability discovered June 5, 2026: Contacted vendor June 7, 2026: Vendor replied June 24, 2026: Public disclosure References GitHub Repository: https://github.com/frappe/frappe Security Page: https://github.com/frappe/frappe/security Credits Discoverer: Oscar Uribe (Fluid Attacks Offensive Team) Tool: AI SAST Scanner System Information Product: Frappe Framework Version: 17.0.0-dev Operating System: Any Mitigations Current Status: No patches available. Recommendation: Wait for the official patch or implement temporary mitigation measures, such as restricting access to the Number Card component and avoiding the execution of untrusted data. Summary This vulnerability is a Stored Cross-Site Scripting (Stored XSS) found in the Number Card component of Frappe Framework version 17.0.0-dev. Attackers can store malicious payloads in the field, causing arbitrary JavaScript code to be executed when other users open the affected Number Card. There is currently no official patch available; temporary mitigation measures are recommended.

Goal Reached Thanks to every supporter — we hit 100%!

Frappe Framework 17.0.0-dev Stored XSS via eval in Number Card (CVE-2026-50710)