The vulnerability arises from an unsafe eval call that processes user‑controlled data within the Number Card component’s filters_config field, allowing attackers to store malicious JavaScript that is later served to users when the filter is used. The weakness is categorized as CWE‑79, reflecting improper handling of untrusted input.

The affected product is Frappe Framework 17.0.0‑dev, which is distributed for Linux, macOS and Windows platforms.

The CVSS score of 4.6 indicates a moderate severity, and the EPSS score is not available, making it unclear how frequently this flaw is actively exploited in the wild. It is not listed in the CISA KEV catalog. The most likely attack vector is a web‑based interface that accepts user input for Number Card filters_config; an attacker with sufficient privileges to insert content can persist a malicious script that will execute in the context of any user who views the filtered data.