VulnSocial

CVE-2026-3673Disclosure(frappe / frappe)

LOWCVSS 5.4 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping. This issue affects Frappe: 16.10.10.

frappe CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • frappe

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-04-23)
  • 3 total mentions across 2 days

Affected systems

Vendors
frappe
Products
frappe

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-22: 1Mentions · 2026-04-23: 2Technical Details · 2026-04-23: 204-2204-23
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-04-221
Disclosure1
2026-04-232
Disclosure2
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-3673 An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered.… https://www.cve.org/CVERecord?id=CVE-2026-3673 ----- Traducción: CVE-2026-3673 Un … http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-3673 and briefly describes how an authenticated attacker can inject a malicious tag to execute JavaScript, but provides no PoC, exploit code, or patch info.

    0000029
    72 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-3673 An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered.… https://www.cve.org/CVERecord?id=CVE-2026-3673

    Post summary

    The statement discloses that CVE-2026-3673 is an XSS flaw where authenticated users can store malicious tag values, leading to JavaScript execution when a victim views the list/report. No evidence of exploitation, PoC, or patch discussion is provided.

    00000105
    57.2K followersView on X
  • Fluid Attacks@fluidattacks
    Disclosure

    🚨 New zero-day in Frappe | Detected by our AI SAST scanner and disclosed by Oscar Uribe. As a #CNA, we assigned CVE-2026-3673. Details: 🔗 https://fluidattacks.com/advisories/silvio. We have announced 231 #CVEs to this date: 🔗 https://fluidattacks.com/advisories/ https://t.co/XlEtXJRxq6

    Post summary

    FluidAttacks disclosed CVE-2026-3673 as a new zero‑day vulnerability in Frappe, directing readers to an advisory link for further details.

    0000087
    866 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appfrappefrappe16.10.10--

Explore more

Back to dashboardfrappe CVEsfrappe vulnerabilities