CVE-2026-50709 is a stored XSS vulnerability in Frappe Framework 17.0.0-dev caused by improper sanitization of user input in the Notifications > Events panel. This allows attackers with low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users viewing the affected panel. The vulnerability has a CVSS 4.8 (medium) with network attack vector, low attack complexity, and no privileges required beyond low-level user access. No official patch or remediation guidance is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, the attack requires user interaction and low privileges, limiting the scope and impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with input in the Notifications > Events panel and consider restricting access to trusted users only. Monitor vendor channels for updates regarding an official fix.