Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component. The application renders audit diff values using microtemplates and appends the resulting content directly into the Desk DOM, allowing attacker-controlled data stored in audit records to be interpreted as active HTML or JavaScript when viewed by other users.

Both rendering paths are unsafe:

• Changed fields / updated rows (audit_trail.html)

• Rows added / rows removed (audit_trail_rows_added_removed.html)

Both are inserted with jQuery .appendTo(...) without HTML escaping.

Vulnerability

Case A: changed-fields path (render_changed_fields)

1. Source persistence:

   • A tracked + submittable document chain (original -> amended) stores a malicious compared value.

2. Server propagation:

   • compare_document() returns changed / row_changed from get_diff(...).

3. Client rendering:

   • render_changed_fields() -> frappe.render_template("audit_trail", render_dict).

   • audit_trail.html uses raw <td>{{ value }}</td>.

4. Sink:

   • $(rendered_html).appendTo(frm.fields_dict.version_table.$wrapper.empty()).

5. Impact:

   • HTML is parsed as DOM and handler attributes execute.

Case B: rows-added/rows-removed path (render_rows_added_or_removed)

1. Source persistence:

   • Attacker-controlled child-row value is stored in amended document.

2. Server propagation:

   • compare_document() -> get_rows_added_removed_grid() / filter_fields_for_gridview() returns child values in added / removed.

3. Client rendering:

   • render_rows_added_or_removed() -> frappe.render_template("audit_trail_rows_added_removed", section_dict).

   • audit_trail_rows_added_removed.html uses raw <td>{{ added_or_removed[...] }}</td>.

4. Sink:

   • $(rendered_html).appendTo(frm.fields_dict[key].$wrapper.empty()) (line 117).

5. Impact:

   • Injected HTML executes in Audit Trail view.

Relevant code:

• frappe/frappe/core/doctype/audit_trail/audit_trail.js:91-99

• frappe/frappe/core/doctype/audit_trail/audit_trail.js:103-119

• frappe/frappe/core/doctype/audit_trail/audit_trail.html:29

• frappe/frappe/core/doctype/audit_trail/audit_trail_rows_added_removed.html:24

• frappe/frappe/core/doctype/audit_trail/audit_trail.py:52-71

PoC

URL to open

http://localhost:18080/desk/audit-trail

http://localhost:18080/desk/audit-trail

http://localhost:18080/desk/audit-trail

http://localhost:18080/desk/audit-trail

GUI trigger A (changed-fields)

1. Open Audit Trail form.

2. Set DocType to:

XSS Trail Attach 1773697727069

XSS Trail Attach 1773697727069

XSS Trail Attach 1773697727069

XSS Trail Attach 1773697727069

3. Set Document to:

j02n72gjm6-1

j02n72gjm6-1

j02n72gjm6-1

j02n72gjm6-1

4. Click Compare.

Expected result:

• Fields Changed renders injected HTML.

• JavaScript executes.

Payload used:

/private/files/<img src=x onerror=document.body.dataset.audittrail_gui=3>.txt

/private/files/<img src=x onerror=document.body.dataset.audittrail_gui=3>.txt

/private/files/<img src=x onerror=document.body.dataset.audittrail_gui=3>.txt

/private/files/<img src=x onerror=document.body.dataset.audittrail_gui=3>.txt

GUI trigger B (rows-added / line 117 path)

1. Open Audit Trail form.

2. Set DocType to:

XSS Trail Rows Parent 1773697990976

XSS Trail Rows Parent 1773697990976

XSS Trail Rows Parent 1773697990976

XSS Trail Rows Parent 1773697990976

3. Set Document to:

lebkkim5sr-1

lebkkim5sr-1

lebkkim5sr-1

lebkkim5sr-1

4. Click Compare.

Expected result:

• Rows Added table renders injected child-row HTML.

• JavaScript executes.

Payload used in child table:

/private/files/<img src=x onerror=document.body.dataset.audittrail_rows=1>.txt

/private/files/<img src=x onerror=document.body.dataset.audittrail_rows=1>.txt

/private/files/<img src=x onerror=document.body.dataset.audittrail_rows=1>.txt

/private/files/<img src=x onerror=document.body.dataset.audittrail_rows=1>.txt

Evidence of Exploitation

• Static evidence

  

Our security policy

We have reserved the ID CVE-2026-50698 to refer to this issue from now on.

System Information

• Frappe Framework

• Version 17.0.0-dev

• Operating System: Any

References

• Github Repository: https://github.com/frappe/frappe

• Security: https://github.com/frappe/frappe/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team using the AI SAST Scanner.