Frappe CVE-2026-34606

The CVSS 4.0 vector indicates network-accessible attack (AV:N) with low complexity (AC:L), no special privileges required (PR:N), and no user interaction needed (UI:N), though the integrity impact is limited (VI:L) with no confidentiality or availability impact. The EPSS score and exploitation probability cannot be determined from provided data. However, the absence of any public exploit code or CISA KEV confirmation suggests real-world exploitation risk is currently low despite the favorable attack conditions. The vulnerability is meaningful because stored XSS can enable account hijacking, session theft, and defacement when the application lacks strong output encoding on all user-facing content fields. Organizations using versions 2.27.0-2.47.x should treat this as a moderate-priority patch given the wide version range affected and the persistence mechanism, though immediate emergency response is not warranted without active exploitation signals.

An attacker with network access to a Frappe LMS instance crafts a course lesson, learning activity, or course description containing malicious JavaScript (e.g., stealing session cookies or harvesting credentials). Because the application does not properly encode user input when storing or rendering content, the script persists in the database. When other users (including administrators or instructors) access that course or lesson, the injected script executes in their browsers with their privileges, potentially allowing the attacker to impersonate users, steal authentication tokens, or redirect learners to phishing pages. The attack requires no special authentication or user interaction beyond normal platform usage.