The vulnerability in the Frappe framework originates from an absence of validation and improper permission checks that allow authenticated users to modify other users’ private workspaces. As a result, a malicious actor can submit specially crafted requests that store JavaScript into workspace content, leading to a stored cross‑site scripting (CWE‑79) vulnerability. This flaw permits attackers to steal credentials, deface pages, or inject further payloads within affected user sessions, thereby compromising confidentiality and potentially integrity of private workspace data.

This issue affects all deployments of the Frappe framework (frappe:frappe) running versions earlier than 14.100.2, 15.101.0, or 16.10.0. Key detail from vendor description: the advisory states that the vulnerability is fixed in those exact releases.

CVSS score of 5.1 classifies the flaw as moderate; EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires an authenticated session that has permission to modify private workspaces. Successful exploitation would enable the attacker to inject persistent malicious script that could hijack other users’ sessions or deliver additional attacks.