The vulnerability allows a user with the Workspace Manager role to insert arbitrary HTML or JavaScript into the description field of a Workspace Link. Because that field is marked to bypass XSS filtering, the content is stored unchanged and later rendered inside a Bootstrap popover using an unsafe translation helper, causing any script to execute in the context of users who open the workspace and hover over the description. This permits theft of session tokens and the ability to perform authenticated actions as the victim.

All installations of the Frappe framework from version 15.11.0 through 16.32.0 are vulnerable. The flaw exists in the core Workspace Link doctype, and the ignore_xss_filter flag remains present in the released 15.x and 16.x lines, meaning any system running those releases can be exploited when a workspace link description is edited by a privileged user.

The CVSS score of 5.1 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog, but a public exploit path exists. No EPSS score is available. An attacker must first obtain the Workspace Manager role to inject malicious markup. Once injected, any session that loads the workspace and triggers the popover can be compromised, allowing session hijacking or further authenticated requests.