The vulnerability is a stored Cross‑Site Scripting flaw found in the MultiSelectDialog component of Frappe Framework 17.0.0‑dev. Because user‑controlled input is not properly neutralized, an attacker can inject malicious JavaScript that will be executed whenever the dialog result is rendered in a victim’s browser. The stored nature means the payload persists in the database, exposing every user who views the dialog to the risk of session hijacking, cookie theft, or arbitrary script execution, which directly compromises confidentiality and integrity of the application data.

Affected systems include Frappe Framework 17.0.0‑dev deployed on Linux, macOS, and Windows platforms, as identified by the CPE strings. No other product versions are listed, and the issue is specific to the development branch, implying that users running this snapshot are at risk.

The CVSS score of 4.8 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently a widely exploited or publicly documented threat. Likely attack vectors involve a malicious user creating or modifying options in the MultiSelectDialog or an attacker who can insert data that will later be rendered to other users. The absence of an official workaround means that mitigation primarily relies on upgrading to a fixed release or implementing client‑side safeguards such as output escaping and strict content security policies.