An authenticated attacker can store a crafted tag value in the _user_tags field and trigger JavaScript execution when a victim opens a list or report view where tags are rendered. The renderer interpolates tag content directly into HTML attributes and element content without proper escaping, enabling the attacker to run arbitrary JavaScript code in the victim’s browser. This can lead to data theft, session hijacking, or defacement of the application interface. The vulnerability is a Stored DOM‑XSS flaw, identified as CWE‑79.

The affected product is the Frappe Framework version 16.10.10. The vulnerability exists in deployments on Linux, macOS, and Windows platforms as indicated by the corresponding CPE entries. Only installations that use the vulnerable tag renderer and allow authenticated users to store tag values are impacted.

The CVSS score is 4.6, reflecting moderate complexity and the requirement for authentication. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread active exploitation. Nevertheless, because it enables client‑side code execution, administrators should address it promptly and restrict access to the tag editing functionality until a fix is applied.