1. Home
  2. CVE Database
  3. CVE-2026-3837
MEDIUM · 5.4

CVE-2026-3837

An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter im...

Vulnerability Description

An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping This issue affects Frappe: 16.10.0.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
FrappeFrappe16.10.0

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2026-3837?

CVE-2026-3837 is a vulnerability with a CVSS score of 5.4 (MEDIUM). An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter im...

How severe is CVE-2026-3837?

CVE-2026-3837 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-3837?

Check the references section above for vendor advisories and patch information. Affected products include: Frappe Frappe.