A weakness in the escaping of user‑supplied content in Frappe allows crafted HTML to be rendered unfiltered in web browsers, giving attackers the ability to inject malicious scripts. The injected code can steal session data, deface the interface, or perform actions on behalf of the user, directly compromising confidentiality, integrity, and availability of the application for anyone who views the affected page.

The flaw affects the Frappe platform before version 13.52.0 and all 14.x releases prior to 14.31.0. Any installation of these versions that renders user input without sufficient escaping is susceptible.

The vulnerability carries a CVSS score of 5.1, indicating moderate severity, and has no available EPSS or KEV listing, implying it has not yet been widely exploited. Attackers can exploit it by submitting malicious HTML or script content that bypasses the platform’s output encoding, causing a browser to execute the payload for any user who accesses the rendered page. Successful exploitation leads to cross‑site scripting attacks that could compromise user credentials and data.