A stored cross‑site scripting flaw resides in the reference_document field of the Auto Repeat dashboard of Frappe Framework 17.0.0-dev. An attacker who can write to Auto Repeat can embed arbitrary HTML or JavaScript. When another user opens the affected form, the malicious code executes in that user’s browser, allowing the attacker to hijack sessions, steal cookies, or perform other client‑side attacks. The flaw does not provide direct arbitrary code execution on the server, so the scope is limited to the victim’s browser context.

Frappe Framework 17.0.0-dev, operating on Linux, macOS and Windows platforms.

The CVSS score of 4.6 indicates moderate risk. EPSS data is unavailable, and the vulnerability is not listed in the KEV catalog; thus, exploit likelihood is not currently quantified. The attack requires an authenticated user with write access to Auto Repeat, so it relies on existing credential compromise or privilege escalation. Without such access, the vulnerability is unusable, but once access is obtained, script execution can be achieved in any user session that opens the form.