CVE-2026-81731

Name of the Vulnerable Software and Affected Versions Frappe versions 15.11.0 through 16.32.0

Description The software stores and renders workspace card descriptions without Cross-Site Scripting (XSS) filtering. This occurs because the description field of the Workspace Link doctype is configured to ignore XSS filters, causing the sanitize content() function in frappe/model/base document.py to store the submitted value without sanitization. Subsequently, the LinksWidget.set body() function in frappe/public/js/frappe/widgets/links widget.js interpolates this content into a Bootstrap popover without HTML escaping. A user with the Workspace Manager role can inject arbitrary markup into a public workspace card description. This markup executes in the session of any user who hovers over the description, potentially allowing session token theft and unauthorized authenticated requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.