VulnerabilityDeferred

CVE-2026-47739

Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization.

MEDIUM 6.9EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.26% probability · 18th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: security-advisories@github.com

References

https://github.com/frappe/frappe/security/advisories/GHSA-vxmp-h244-wv3r

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.