CVE-2026-81731 - Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
Brief
CVE ID : CVE-2026-81731
Published : Aug. 27, 2026, 8:18 p. m.
- 55 minutes ago
Description : Frappe 15.
- 0 through 16.
- 0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore_xss_filter": 1 in frappe/desk/doctype/workspace_link/workspace_link. json, and _sanitize_content() in frappe/model/base_document. py skips any field carrying that flag, so the value is stored exactly as submitted. frappe.
desk. desktop. get_desktop_page returns it unchanged, and LinksWidget. set_body() in frappe/public/js/frappe/widgets/links_widget. js interpolates it into a Bootstrap popover created with html: true, by way of the __() translation helper, which performs no HTML escaping.