---
id: CVE-2026-109602
title: >-
  Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site
  scripting vulnerability in dashboard chart filters because jQuery renders
  entered filter values as rich text
summary: >-
  Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site
  scripting vulnerability in dashboard chart filters because jQuery renders
  entered filter values as rich text. Authenticated attackers can store
  malicious filter …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:24.107'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109602'
references:
  - url: 'https://github.com/frappe/frappe/security/advisories/GHSA-hxfh-hh23-fvch'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-before-16.31.0-stored-xss-via-dashboard-chart-filters
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.615Z'
---

## Overview

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.