A stored Cross‑Site Scripting (XSS) flaw exists in Frappe Framework 17.0.0‑dev. The issue arises from improper neutralization of user‑controlled input in the Notifications > Events panel, allowing attackers to inject malicious script that runs whenever the event is viewed. This could lead to session hijacking, data theft, or further compromise of the affected system.

The vulnerability affects the Frappe Framework product version 17.0.0‑dev. All operating systems supported by the framework (Linux, macOS, Windows) are impacted because the flaw is present in the shared code base. No other versions or configurations are listed, so the risk is confined to deployments using this specific development build.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is unavailable, suggesting limited known exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation likely requires an authenticated session with permission to create or modify notification events, implying a higher attack effort. Because the flaw is stored, it can affect all users who view the crafted event. The best defense is to apply the vendor’s fix or upgrade to a later release that eliminates the XSS path.