Executive Summary

CVE-2026-50699 is a Stored Cross-Site Scripting (XSS) vulnerability found in Frappe Framework version 17.0.0-dev. It allows an authenticated attacker who has write access to the Auto Repeat feature to inject malicious HTML or JavaScript code into the reference_document field via a whitelisted write path.

When other users open the affected Auto Repeat form, the malicious script is executed in their browsers because the client-side rendering process includes the unescaped reference_document content directly into the dashboard HTML without proper escaping or sanitization.

This happens because the server returns the unescaped reference_document in schedule_details, and the client-side template uses frappe.render_template to render it directly into the DOM, leading to script execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of arbitrary scripts in the browsers of users who open the affected Auto Repeat form. Such script execution can be used to steal user credentials, hijack user sessions, perform actions on behalf of the user, or deliver malicious payloads.

Since the attacker needs authenticated write access to the Auto Repeat feature, the risk is limited to users with such privileges, but the impact on affected users can be significant.

The vulnerability is remotely exploitable and has a CVSS v4.0 base score of 4.6, indicating a medium severity level.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Auto Repeat feature in Frappe Framework version 17.0.0-dev allows an authenticated user with write access to inject HTML or JavaScript into the reference_document field. Since the issue involves unescaped rendering of this field in the client-side dashboard, detection involves verifying if malicious scripts can be persisted and executed when opening the affected Auto Repeat form.

No specific detection commands are provided in the available resources. However, detection could involve attempting to update the reference_document field via the whitelisted write path with a benign script payload and then observing if the script executes upon opening the Auto Repeat form.

Useful 0 Not Useful 0

Mitigation Strategies

No patch is currently available for this vulnerability. Immediate mitigation steps include restricting write access to the Auto Repeat feature to only fully trusted users to prevent injection of malicious scripts.

Additionally, users should be cautious when opening Auto Repeat forms and consider implementing additional input validation or escaping on the reference_document field if possible.

Useful 0 Not Useful 0