CVE-2026-109602

Deferred Deferred - Pending Action

Stored XSS in Frappe Dashboard Chart Filters

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109602

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Frappe versions before 15.118.0 and 16.x before 16.31.0 have a stored cross-site scripting (XSS) vulnerability in dashboard chart filters. This happens because jQuery renders user-entered filter values as rich text without proper sanitization. Attackers with authentication can inject malicious scripts into these filters, which then execute in the browsers of users viewing the affected dashboard charts.

Detection Guidance

To detect this vulnerability, inspect dashboard chart filters in Frappe for stored scripts. Check for unusual or obfuscated input in filter values that may render as executable code. Review browser console logs for XSS errors when viewing dashboards.

Impact Analysis

If you use a vulnerable Frappe version, an authenticated attacker could store malicious scripts in dashboard chart filters. When you or other users view these charts, the scripts may execute in your browser, potentially stealing session cookies, redirecting you to malicious sites, or performing actions on your behalf without your consent.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Frappe to version 15.118.0 or later, or 16.31.0 or later if using version 16.x. Remove or sanitize any suspicious filter values in existing dashboards. Implement input validation for chart filter fields to block script tags or HTML.

Hi! I’m here to help you understand CVE-2026-109602. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70