Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component. An authenticated attacker can create or modify a Number Card and store a malicious payload in the filters_config field.

When another user opens the affected Number Card in Desk, client-side code evaluates the stored filters_config value using eval, resulting in arbitrary JavaScript execution in the victim's browser. Multiple reported variants have been consolidated under a single vulnerability because they share the same root source (filters_config) and execution sink (eval).

Vulnerability

Case 1: Stored JS execution via eval (primary case)

1. Source: attacker-controlled input in Number Card.filters_config (Type = Custom).

2. Persistence: value is stored and returned to Desk clients when the document is opened.

3. Primary sink:

   • frm.filters = eval(frm.doc.filters_config); on refresh.

   • frm.filters = eval(frm.doc.filters_config); on filters_config change.

4. Impact: arbitrary JavaScript executes in the authenticated victim browser context.

Case 2: Derived HTML injection path after eval (same CVE, same root cause)

1. After eval, the generated filter data is rendered into HTML rows using template literals.

2. render_filters_table and set_dynamic_filters_in_table append HTML via jQuery .append() / .html().

3. This is treated as a secondary/derived path of the same vulnerability family, not a separate CVE, because exploitation is already achieved at eval.

Relevant code:

• frappe/frappe/desk/doctype/number_card/number_card.js:25

• frappe/frappe/desk/doctype/number_card/number_card.js:93

• frappe/frappe/desk/doctype/number_card/number_card.js:197-255

• frappe/frappe/desk/doctype/number_card/number_card.js:548-568

• frappe/frappe/desk/doctype/number_card/number_card.py:205-212 (whitelisted creation path)

PoC

Reproduction

1. Login to Desk:

   • http://localhost:18080/login

2. Open Number Card list:

   • http://localhost:18080/desk/number-card/view/list

3. Click Add Number Card.

4. Set fields:

   • Label: MCP Eval XSS PoC 2

   • Type: Custom

   • Method: frappe.desk.doctype.number_card.number_card.get_result

   • Filters Configuration: (alert(9222), [])

5. Click Save.

6. Observe that alert executes.

7. Return to list view and open MCP Eval XSS PoC 2 again.

8. Observe alert executes again (stored/persistent behavior).

Expected result:

• JavaScript alert(9222) executes in the browser when the malicious Number Card is opened.

Evidence of Exploitation

• Video of exploitation

  

• Static evidence

  

Our security policy

We have reserved the ID CVE-2026-50705 to refer to this issue from now on.

System Information

• Frappe Framework

• Version 17.0.0-dev

• Operating System: Any

References

• Github Repository: https://github.com/frappe/frappe

• Security: https://github.com/frappe/frappe/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team using the AI SAST Scanner.