An authenticated attacker can persist crafted values in multiple field types and trigger client‑side script execution when another user opens the affected document in Desk. The vulnerable formatter interpolates stored values into raw HTML attributes and element content without escaping, allowing the attacker’s script to run in the victim’s browser.

The Frappe Framework version 16.10.0 is affected. No other versions or vendors are listed.

The CVSS score of 4.6 classifies this as medium severity and indicates that user authentication is required for exploitation. The EPSS score of < 1% shows an extremely low likelihood of exploitation in practice. The vulnerability is not included in the CISA KEV catalog. An attacker must first be authenticated to store malicious data; a second authenticated user must then view the document in Desk for the injected script to execute, and the impact is limited to the victim’s browser.