A stored cross‑site scripting vulnerability exists in Frappe Framework 17.0.0‑dev caused by insufficient neutralization of untrusted input used within the Form Dashboard headline renderer. This flaw allows an attacker to inject arbitrary HTML or JavaScript that will be rendered when the dashboard headline is displayed. If executed, the malicious script runs in the context of any user who views the dashboard, potentially enabling theft of session cookies, credential phishing, or defacement.

The vulnerability affects installations of Frappe Framework version 17.0.0‑dev across Linux, macOS, and Windows platforms. Any instance running this development release that exposes editable dashboard headlines is susceptible. No other product or version variants are listed.

The CVSS score is 4.6, indicating moderate severity. Exploit probability data is not available, and the flaw is not recorded in the CISA KEV catalog. The likely attack vector involves an authenticated user or an attacker with permission to modify the dashboard headline, which then stores malicious payload that is rendered for all viewers. Because the payload is stored, the impact can be widespread among multiple users, but it requires the attacker to supply content that is accepted by the dashboard interface.