A stored cross‑site scripting flaw exists in the Frappe framework’s report and list view functionality. The vulnerability is triggered when the field set_link_title_field_value contains unencoded JavaScript, allowing an attacker to embed malicious code that runs in the browsers of any user who views the affected report or list. The flaw is classified as CWE‑79 and can lead to theft of session cookies, credential hijacking, or arbitrary script execution on client machines.

All versions of the Frappe full‑stack web application framework released before 15.107.2 and 16.17.4 are affected. Those builds are vulnerable to the stored XSS flaw in the report and list view components.

The CVSS score of 6.9 indicates a moderate risk, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at the time of assessment. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation requires an authenticated user with permission to edit report or list configurations to inject malicious data; after injection, any user who views the report will execute the stored code in their browsers.