Press, a Frappe custom app for managing infrastructure and SaaS on Frappe Cloud, contains a reflected XSS vulnerability in the redirect parameter on its login page. This vulnerability arises from improper input neutralization (CWE-79). The issue is fixed by a patch that restricts redirect URLs to internal addresses only, preventing malicious external redirects. The vulnerability affects versions prior to commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6. The CVSS 4.0 score is 1.3, indicating low severity, and no public exploits are known.

An attacker could exploit the reflected XSS vulnerability by crafting a malicious URL that uses the redirect parameter to execute arbitrary scripts in the context of the user's browser. This could potentially lead to user session hijacking or other client-side impacts. However, the low CVSS score and lack of known exploits suggest limited impact. The patch restricts redirects to internal URLs, effectively mitigating the risk.

A patch is available and identified by commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6, which restricts redirect parameters to internal URLs only. Users and administrators should update to this patched version to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the patch to affected deployments. Patch status is confirmed by the provided commit reference.