CVE-2026-81731: Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent() in frappe/model/basedocument.py skips any field carrying that flag, so the value is stored exactly as submitted. frappe.desk.desktop.getdesktoppage returns it unchanged, and LinksWidget.setbody() in frappe/public/js/frappe/widgets/linkswidget.js interpolates it into a Bootstrap popover created with html: true, by way of the () translation helper, which performs no HTML escaping. A user holding the Workspace Manager role can therefore place arbitrary markup in a public workspace's card description and have it execute in the session of any desk user who opens that workspace and hovers the description, including higher-privileged users, allowing session token theft and authenticated requests as the victim. The flag is removed on the development branch but remains present in the shipped 15.x and 16.x release lines, so no released version carries the fix.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
A user with the Workspace Manager role can add arbitrary markup to the description of a card in a public workspace. Any desk user who opens that workspace and hovers the description can execute the payload, including users with higher privileges.
Does exploitation require a victim interaction?
Yes. The victim must open the affected public workspace and hover the workspace card description containing the malicious content. The attacker must already have the Workspace Manager role to create the payload.
Are default released versions affected?
All released versions in the affected 15.11.0 through 16.32.0 range remain affected. Although the unsafe flag was removed on the development branch, the data states that no released version includes that fix.
What can be done if a fixed release is not available?
Restrict the Workspace Manager role to trusted administrators and review public workspace card descriptions for untrusted HTML or script-like markup. Limiting access to public workspaces containing untrusted descriptions reduces exposure to desk users.
How can administrators identify potentially malicious content?
Inspect Workspace Link records used by public workspaces, particularly their description fields. Content is stored without XSS filtering and is rendered as HTML in the workspace-card popover, so unexpected HTML markup in descriptions should be treated as suspicious.