CVE-2026-109602

5.4Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers can execute malicious scripts in other users' browsers when they view dashboard charts. Exploitation requires network access, valid credentials to inject filter values, and a victim to load the affected dashboard.

Root cause

Dashboard chart filters render input values as rich text via jQuery without proper sanitization.

Affected systems

Frappe versions before 15.118.0 and 16.x before 16.31.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Frappe to version 15.118.0 or 16.31.0 or higher. No interim mitigation is documented, so patch immediately.

shell

$ bench update --apps frappe

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109602