CVE-2026-81731

Received Received - Intake

XSS in Frappe Workspace Card Description

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore_xss_filter": 1 in frappe/desk/doctype/workspace_link/workspace_link.json, and _sanitize_content() in frappe/model/base_document.py skips any field carrying that flag, so the value is stored exactly as submitted. frappe.desk.desktop.get_desktop_page returns it unchanged, and LinksWidget.set_body() in frappe/public/js/frappe/widgets/links_widget.js interpolates it into a Bootstrap popover created with html: true, by way of the __() translation helper, which performs no HTML escaping. A user holding the Workspace Manager role can therefore place arbitrary markup in a public workspace's card description and have it execute in the session of any desk user who opens that workspace and hovers the description, including higher-privileged users, allowing session token theft and authenticated requests as the victim. The flag is removed on the development branch but remains present in the shipped 15.x and 16.x release lines, so no released version carries the fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-81731

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	From 15.11.0 (inc) to 16.32.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Frappe versions 15.11.0 through 16.32.0. The description field of the Workspace Link doctype is stored without XSS filtering due to an 'ignore_xss_filter' flag. When rendered, the unfiltered content is inserted into a Bootstrap popover without HTML escaping, allowing arbitrary script execution when a user hovers over the description.

Detection Guidance

Check Frappe versions between 15.11.0 and 16.32.0. Inspect Workspace Link doctype configurations for the ignore_xss_filter flag. Review workspace card descriptions for unexpected markup or scripts. Monitor user reports of unusual popups or session behavior.

Impact Analysis

A user with the Workspace Manager role can inject malicious scripts into a workspace card description. When other users open the workspace and hover over the description, the script executes in their session. This can lead to session token theft and allow attackers to perform authenticated requests as the victim, including actions by higher-privileged users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Session token theft may enable attackers to access protected health information or personal data, resulting in compliance breaches and potential legal consequences.

Mitigation Strategies

Upgrade to a patched version if available. Remove the ignore_xss_filter flag from workspace_link.json. Replace description fields with plain text or sanitized HTML. Restrict Workspace Manager role privileges. Monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-81731. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70