Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer. The application stores desktop icon metadata in Desktop Icon records and renders the label value directly into the data-id attribute of an HTML <a> element without attribute escaping.

An attacker with permission to create or modify Desktop Icon records can inject a quote-breaking payload into the label field, resulting in the injection of arbitrary HTML attributes such as JavaScript event handlers. When another user interacts with the affected icon, attacker-controlled code may execute in the victim's browser.

Vulnerability

Case A: Desktop Icon.label attribute injection in desktop grid

1. Source persistence: attacker-controlled icon data is saved via save_layout (desktop_icon.update(icon) + desktop_icon.save()).

2. Server propagation: get_desktop_icons returns persisted records into boot data (frappe.desktop_icons).

3. Client interpolation: desktop icon HTML is built with unescaped icon.label in template:

   • <a class="desktop-icon" data-id="{{ icon.label}}" ...>

4. Sink: HTML is parsed and inserted via frappe.render_template("desktop_icon", ...) and jQuery element construction.

5. Impact: quote-breaking payload injects executable attributes and runs JavaScript in authenticated Desk sessions.

Case B: claim focus on InlineEditor / line 1068

• InlineEditor (${__(this.currentValue)}) exists, and __() is not an HTML escaper.

• However, the validated exploitation path does not require this code path.

• The confirmed root sink is the desktop icon template attribute injection (desktop_icon.html), not setup_click line 1068 (href) as primary vector.

Relevant code:

• frappe/frappe/desk/doctype/desktop_layout/desktop_layout.py:28-57

• frappe/frappe/desk/doctype/desktop_icon/desktop_icon.py:162-225

• frappe/frappe/desk/page/desktop/desktop.js:878-883

• frappe/frappe/public/js/frappe/ui/desktop_icon.html:1

• frappe/frappe/public/js/frappe/translate.js:5-26

PoC

1. Login to Desk at:

http://localhost:18080/desk

http://localhost:18080/desk

http://localhost:18080/desk

http://localhost:18080/desk

2. Insert a malicious Desktop Icon label payload (validated marker example):

DESKTOP-MCP-1773673721631" onmouseover="window.__desktop_xss=1

DESKTOP-MCP-1773673721631" onmouseover="window.__desktop_xss=1

DESKTOP-MCP-1773673721631" onmouseover="window.__desktop_xss=1

DESKTOP-MCP-1773673721631" onmouseover="window.__desktop_xss=1

3. Ensure the icon is rendered in desktop grid (validated by adding a child icon to a folder icon so it is visible).

4. Reload Desk.

5. Hover the malicious desktop icon.

Expected result:

• JavaScript executes on hover (window.__desktop_xss becomes 1, or alert(document.domain) if using alert payload).

Evidence of Exploitation

• Static evidence:

  

Our security policy

We have reserved the ID CVE-2026-50699 to refer to this issue from now on.

System Information

• Frappe Framework

• Version 17.0.0-dev

• Operating System: Any

References

• Github Repository: https://github.com/frappe/frappe

• Security: https://github.com/frappe/frappe/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team using the AI SAST Scanner.