Stored XSS Vulnerability in Frappe Workspace Link Description

CVE-2026-81731

What is CVE-2026-81731?

A stored XSS vulnerability exists in Frappe versions 15.11.0 through 16.32.0, where the Workspace Link description is rendered without proper XSS filtering. The 'ignore_xss_filter' flag set in the Workspace Link doctype allows unfiltered content submission. Consequently, users with the Workspace Manager role can inject arbitrary markup in a public workspace’s card description. When other users hover over this description, the malicious markup is executed within their session, potentially leading to session token theft and unauthorized actions on behalf of the victim, including higher-privileged user accounts. Although a patch is available in the development branch, it is not present in any released version, leaving these versions vulnerable.

References