CVE-2026-109602: Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters
Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe versions before 15.118.0 are affected, as are 16.x versions before 16.31.0.
What access does an attacker need to exploit this issue?
The attacker needs an authenticated Frappe account and must be able to enter a malicious value into a dashboard chart filter. A user must then view the affected dashboard chart for the stored script to execute.
What is the impact on users who view a malicious chart?
Script can execute in the viewer's browser in the context of the application. The listed impacts include limited confidentiality and integrity effects, and the vulnerability affects a different security scope.
How can teams identify possible prior exploitation?
Review dashboard chart filter values for unexpected or malicious markup or script content, particularly in charts editable by authenticated users. The available information does not identify specific log events or indicators beyond malicious stored filter values.