CVE-2026-3673 — Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer
An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vuln…
Published: 2026-04-22 · CVSS: 4.6 · CVSS 4.0
An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping. This issue affects Frappe: 16.10.10.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7