Executive Summary

CVE-2026-50700 is a Stored Cross-Site Scripting (XSS) vulnerability found in Frappe Framework version 17.0.0-dev. It occurs because the function frappe.get_avatar improperly handles user-controlled input by directly inserting the image_url value into an HTML template string without proper escaping or sanitization.

An attacker who has write access to a record with an image field can inject malicious markup into the Attach Image value. When the affected record is displayed, this malicious code is inserted into the webpage's DOM and executed in the victim's browser.

This vulnerability affects features like Link Preview and Global Search, where the malicious payload travels through multiple functions before being executed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary scripts in the context of a victim's browser session when they view a compromised record. This can lead to unauthorized actions such as stealing session tokens, performing actions on behalf of the user, or delivering malicious payloads.

Since the vulnerability is remotely exploitable and requires only write access to a record, it can be leveraged to compromise user accounts or data confidentiality within the affected application.

The CVSS v4.0 base score of 4.6 indicates a medium severity impact.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if the Frappe Framework version 17.0.0-dev is in use and checking for the presence of malicious markup injected into image fields, particularly those related to the `frappe.get_avatar` function.

Since the vulnerability involves improper neutralization of user-controlled input in the `image_url` field that is assigned to `innerHTML`, detection can involve inspecting records with image fields for suspicious or unexpected HTML or script content.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

As no patch is currently available for this vulnerability, immediate mitigation steps include restricting write access to records containing image fields to trusted users only.

Additionally, monitoring and sanitizing user inputs, especially those that affect the `frappe.get_avatar` function, can help reduce the risk of exploitation.

Consider implementing additional security controls such as Content Security Policy (CSP) headers to limit the impact of potential XSS payloads.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the Stored Cross-Site Scripting (XSS) vulnerability in Frappe Framework version 17.0.0-dev affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0