CVE-2026-109602

The Frappe framework (versions before 15.118.0 and 16.x before 16.31.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw within the dashboard chart filters. The root cause is that jQuery renders entered filter values as rich text without sufficient sanitization. This allows authenticate...