A stored cross‑site scripting vulnerability exists in Frappe Framework 17.0.0‑dev due to improper neutralization of user‑controlled input in the frappe.get_avatar function. The flaw allows an attacker to embed malicious script code that will be executed in the context of the victim’s browser whenever the avatar image is rendered. This can lead to credential theft, session hijacking, defacement, or delivery of malware to users who view the affected avatar.

The affected product is the Frappe Framework 17.0.0‑dev version running on Linux, macOS, or Windows operating systems.

The CVSS score of 4.6 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious avatar image that will be rendered by a user’s browser; therefore, the attack vector is likely client‑side and depends on a user visiting the page where the avatar is displayed. The risk remains moderate under typical usage scenarios, but any path that allows untrusted users to provide avatar images makes the attack reasonable.