A reflected cross‑site scripting flaw arises in the dashboard‑view breadcrumb rendering of Frappe Framework 17.0.0‑dev because user‑controlled input is not properly neutralized. The erroneous rendering allows an attacker to inject arbitrary JavaScript that executes in the victim’s browser session, potentially leading to credential theft, defacement, or other in‑browser attacks. The weakness is classified as CWE‑79.

The vulnerability affects the Frappe Framework across all supported operating systems for the development release 17.0.0‑dev, including Linux, macOS, and Windows distributions. Any deployment running this version is exposed.

The severity is moderate, reflected in a CVSS score of 5.1, and no EPSS data is available. The flaw is not listed in the CISA KEV catalog. Because it is a reflected XSS, exploitation typically requires a social‑engineering or phishing vector to lure a user into visiting a malicious link that triggers the injected script. Once executed, the attacker can hijack the user’s session or perform client‑side attacks.