Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering

Description

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component. The breadcrumb generation logic reads route data directly from the browser URL and injects it into the page without performing adequate output encoding or sanitization.

A specially crafted URL can contain malicious HTML or JavaScript within a route segment. The router decodes the attacker-controlled segment and passes it to the breadcrumb rendering logic. Subsequently, set_dashboard_breadcrumb() inserts the value into the DOM through jQuery HTML parsing, causing the injected content to be interpreted as active markup rather than plain text.

An attacker can exploit this vulnerability by enticing a victim to visit a crafted URL. Successful exploitation results in arbitrary JavaScript execution in the context of the victim's session, potentially leading to session hijacking, unauthorized actions, data disclosure, or other impacts associated with reflected cross-site scripting vulnerabilities.

Vulnerability

Case A: reflected XSS via dashboard-view/<payload> route segment

1. Source: attacker-controlled route segment in URL path.

2. Propagation:

   • frappe.router.parse() splits route and applies decodeURIComponent via decode_component.

   • decoded value is available in frappe.get_route()[1].

3. Sink:

   • set_dashboard_breadcrumb() builds HTML using template literal with unescaped docname and appends via jQuery:

   • $(`<li><a href="${dashboard_route}">${__(docname)}</a></li>`).appendTo(...)

4. Impact: injected HTML is parsed and event handlers execute (reflected DOM XSS).

Relevant code:

• frappe/frappe/public/js/frappe/router.js:154-158

• frappe/frappe/public/js/frappe/router.js:568-570

• frappe/frappe/public/js/frappe/views/breadcrumbs.js:84-87

• frappe/frappe/public/js/frappe/views/breadcrumbs.js:253-257

PoC

Browser URL PoC

Open while authenticated in Desk:

http://localhost:18080/desk/dashboard-view/%3Cimg%20src%3Dx%20onerror%3Dalert(9091)%3E

http://localhost:18080/desk/dashboard-view/%3Cimg%20src%3Dx%20onerror%3Dalert(9091)%3E

http://localhost:18080/desk/dashboard-view/%3Cimg%20src%3Dx%20onerror%3Dalert(9091)%3E

http://localhost:18080/desk/dashboard-view/%3Cimg%20src%3Dx%20onerror%3Dalert(9091)%3E

Non-dialog deterministic payload:

http://localhost:18080/desk/dashboard-view/%3Cimg%20src%3Dx%20onerror%3Ddocument.body.dataset.bcxss%3D1%3E

http://localhost:18080/desk/dashboard-view/%3Cimg%20src%3Dx%20onerror%3Ddocument.body.dataset.bcxss%3D1%3E

http://localhost:18080/desk/dashboard-view/%3Cimg%20src%3Dx%20onerror%3Ddocument.body.dataset.bcxss%3D1%3E

http://localhost:18080/desk/dashboard-view/%3Cimg%20src%3Dx%20onerror%3Ddocument.body.dataset.bcxss%3D1%3E

Expected result:

• JavaScript executes from the injected breadcrumb node.

Evidence of Exploitation

• Static evidence:

  

Our security policy

We have reserved the ID CVE-2026-50701 to refer to this issue from now on.

System Information

• Frappe Framework

• Version 17.0.0-dev

• Operating System: Any

References

• Github Repository: https://github.com/frappe/frappe

• Security: https://github.com/frappe/frappe/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team using the AI SAST Scanner.