CVE-2026-3837: Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters
An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping
This issue affects Frappe: 16.10.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3837?
CVE-2026-3837 has been categorized as a medium severity vulnerability due to its potential for stored DOM XSS exploitation.
How do I fix CVE-2026-3837?
To fix CVE-2026-3837, upgrade the Frappe Framework to version 16.10.1 or later, which addresses the vulnerability.
Who is affected by CVE-2026-3837?
Authenticated users of Frappe Framework version 16.10.0 are at risk of CVE-2026-3837.
What type of vulnerability is CVE-2026-3837?
CVE-2026-3837 is a stored DOM Cross-Site Scripting (XSS) vulnerability.
What kind of attack is possible with CVE-2026-3837?
An attacker can persist malicious values and execute client-side scripts when another user accesses the affected document.