CVE-2026-3673

BRIEFING NOTE: CVE-2026-3673 This vulnerability is a stored cross-site scripting (XSS) flaw affecting Frappe version 16.10.10. An authenticated attacker can inject malicious JavaScript code through crafted tag values in the _user_tags field, which is then executed when a victim views list or report pages where those tags are rendered. The vulnerable code fails to properly escape tag content when interpolating it into HTML attributes and element content. The attack requires prior authentication to the Frappe system, reducing the exposure surface compared to unauthenticated vulnerabilities. Once the malicious tag is stored, any user viewing affected list or report views will automatically execute the attacker's JavaScript payload, potentially enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. There is currently no evidence of active exploitation in the wild. The vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalog and remains on the inactive Hot List. The FAUCET Risk Score of 39.0 and EPSS score of 0.0007 indicate relatively low prioritization among all disclosed vulnerabilities, though the stored XSS nature warrants prompt patching before threat actors develop and distribute exploit code.