| Package | Affected versions | Patched versions |
|---|---|---|
| frappe | ≥ 12.0.0, ≤ 12.0.8 |
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free