XSS in Frappe Framework

CVE-2026-50708

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (15.2th percentile) — read the EPSS interpretation.