Frappe Framework v16.10.0 - Stored DOM XSS in Multiple Field Formatters

Description

An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping

Validated affected formatters:

• Color.

• Icon.

Vulnerability

The vulnerable path is:

1. Source: attacker-controlled field values for formatter-backed fields are submitted through the normal web flow and tampered with in transit

2. Persistence: the backend stores the crafted values because these field types are not strictly server-validated against their expected allowlists, and the HTML sanitizer is not triggered for payloads without < or >.

3. Sink builders:

   • frappe.form.formatters.Color renders:

     • style="background-color: ${value}"

     • ${value} inside <span class="color-value">

   • frappe.form.formatters.Icon renders:

     • frappe.utils.icon(value, "md")

     • ${value} inside <span class="icon-value">

   • frappe.utils.icon() also interpolates attacker-controlled icon values into <use ... href="${icon_name}"> without escaping.

4. DOM insertion: the formatted HTML is inserted into Desk in display mode, making attribute injection possible.

Relevant code:

• frappe/frappe/public/js/frappe/form/formatters.js:397-409

• frappe/frappe/public/js/frappe/utils/utils.js:1424-1452

• frappe/frappe/public/js/frappe/form/controls/base_input.js

• frappe/frappe/public/js/frappe/form/controls/color.js

• frappe/frappe/public/js/frappe/form/controls/icon.js

• frappe/frappe/model/base_document.py

PoC

Color formatter

1. Log in to Desk as an authenticated user.

2. Open a document containing a Color field. In the local validation environment, the PoC used the custom DocType XSS Parent and document id.

3. Intercept the save request with Burp Suite and replace the Color field value with:

   • red" onmousemove="alert(7441)" x="

4. Forward the request so the tampered value is stored.

5. Visit the affected record in Desk:

   • http://localhost:18080/desk/xss-parent/%3Cdocument_id%3E

6. Move the mouse over the rendered PoC Color value.

Icon formatter

1. Log in to Desk as an authenticated user

2. Open a document containing an Icon field. In the local validation environment, the PoC used the custom DocType XSS Parent and document ID.

3. Intercept the save request with Burp Suite and replace the Icon field value with:

   • folder-normal" onmouseover="alert(7551)" x="

4. Forward the request so the tampered value is stored.

5. Visit the affected record in Desk:

   • http://localhost:18080/desk/xss-parent/document_id

6. Move the mouse over the rendered PoC Icon value.

Evidence of Exploitation

1. Color formatter

   

2. Icon formatter

   

Our security policy

We have reserved the ID CVE-2026-3837 to refer to this issue from now on.

Disclosure policy

System Information

• Frappe

• Version: 16.10.0

• Operating System: Any

References

• Github Repository: https://github.com/frappe/frappe

• Security: https://github.com/frappe/frappe/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team using the AI SAST Scanner.