This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Frappe Framework's Number Card component, specifically in version 17.0.0-dev. Unsafe evaluation of user-controlled data enables stored XSS attacks, which can lead to script execution in the victim's browser. The CVSS 4.6 score reflects a network attack vector with low complexity, requiring high privileges and user interaction, and limited impact on confidentiality, integrity, and availability. No official fix or patch has been published, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of users viewing the affected Number Card component. This may lead to session hijacking, unauthorized actions, or other client-side impacts. However, the attack requires user interaction and high privileges, limiting the overall impact severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when deploying version 17.0.0-dev and consider restricting access to trusted users only. Monitoring vendor channels for updates is recommended.