This vulnerability in Frappe Framework 17.0.0-dev involves improper neutralization of input in the frappe.get_avatar function, leading to stored Cross-Site Scripting (CWE-79). An attacker could inject malicious scripts that are stored and later executed in the context of users viewing affected pages. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and limited scope and impact. No vendor advisory or patch is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application users, potentially leading to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and privileges, limiting its severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply strict input validation and output encoding around the frappe.get_avatar function if possible, and consider limiting user privileges to reduce risk.