Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. (CVE-2026-81731)

The vulnerability arises because the workspace card description field in Frappe 15.11.0 through 16.32.0 is declared with an "ignore_xss_filter" flag, causing the sanitization function to skip filtering on this field. The stored description is then rendered without escaping in a Bootstrap popover with HTML enabled. This allows a user holding the Workspace Manager role to inject arbitrary markup that executes in the context of any desk user who views and hovers over the description, including users with higher privileges. This enables session token theft and authenticated requests as the victim. The flag disabling filtering remains in all shipped 15.x and 16.x releases, with the fix only present on the development branch. No official patch or remediation is currently available.

An attacker with Workspace Manager privileges can inject malicious HTML/JavaScript into the workspace card description. When other users view and hover over the description, the injected script executes in their browser session. This can lead to theft of session tokens and unauthorized actions performed with the victim's privileges. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently available for this vulnerability in released versions. Users should restrict Workspace Manager privileges to trusted personnel only as a temporary mitigation. Monitor vendor advisories for updates and apply any future patches that remove the "ignore_xss_filter" flag from the workspace card description field. Avoid exposing public or shared workspaces to untrusted users until a fix is released.