This vulnerability in Frappe Framework 17.0.0-dev involves improper neutralization of user-controlled input in the MultiSelectDialog component, leading to stored Cross-Site Scripting (CWE-79). An attacker could inject malicious scripts that are stored and later executed in the context of other users. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and limited scope and impact. No known exploits are reported in the wild, and no vendor advisory or patch is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the browsers of users interacting with the vulnerable component, potentially leading to session hijacking, defacement, or other client-side impacts. However, the impact is limited by the need for user interaction and the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when handling untrusted input in the MultiSelectDialog component and consider applying temporary mitigations such as input sanitization or disabling the affected feature if feasible.