A stored cross‑site scripting flaw exists in Frappe Framework 17.0.0‑dev when the Audit Trail component fails to neutralize user‑controlled input before rendering it as HTML. The vulnerable code stores the raw input in the database and later injects it into a browser page without proper encoding. Based on the description, it is inferred that a malicious script could be executed in the browsers of any user who views the affected audit trail entries, potentially allowing an attacker to steal session cookies or perform other client‑side attacks.

Frappe Framework 17.0.0‑dev is affected on Linux, macOS and Windows, as indicated by the common platform enumeration strings. The flaw is present in any deployment of the 17.0.0‑dev release where the Audit Trail component can be influenced by untrusted users.

The CVSS score of 4.6 classifies this issue as moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting a low to moderate exploitation likelihood. Because the flaw is stored, any user or process that can insert or modify audit trail entries represents a potential attack vector. Successful exploitation would compromise the confidentiality of user sessions and could lead to credential theft or session hijacking, but does not directly affect system integrity or availability.