EUVD-2026-54175Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery, low complexity; PR:L for required import permission; UI:R for victim navigation; S:C and C:L/I:L for cross-user session impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.
AnalysisAI
Stored cross-site scripting in Frappe's Data Import feature allows an authenticated user with import permissions to inject persistent script payloads via maliciously crafted column headers in imported files. The unescaped headers are rendered in import preview and warning messages, causing script execution in the browser of any other user who subsequently views the import interface. Affected are all Frappe deployments on the 15.x branch prior to 15.109.0 and the 16.x branch prior to 16.19.0; no active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis.
Technical ContextAI
Frappe is a Python and JavaScript full-stack web framework that underpins ERPNext and several other enterprise applications. The Data Import doctype allows privileged users to bulk-load records from CSV or Excel files. Column headers from the uploaded file are used in multiple rendering contexts: in the JavaScript import preview widget (import_preview.js), in the column-warning overlay (data_import.js), and in Python-generated warning messages returned by importer.py. In all these locations, the raw header_title value was interpolated directly into HTML or passed to frappe.bold() without sanitization, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix applied frappe.utils.escape_html() in JavaScript and escape_html() in Python across all five affected rendering sites, as confirmed by commits 002a36a and 2bf7b9d. Because the stored payload survives across sessions, this is a persistent (stored) XSS rather than a reflected variant.
RemediationAI
Upgrade Frappe to version 16.19.0 (16.x branch) or 15.109.0 (15.x branch); these are the vendor-confirmed fixed releases per GitHub advisory GHSA-7f28-gm9h-q6rg (https://github.com/frappe/frappe/security/advisories/GHSA-7f28-gm9h-q6rg). The underlying changes are in commits 002a36a2668781366e4bf1ff144da5e53446f540 and 2bf7b9d0b4c7f815de1c85695e9a027ecce8bed9. If an immediate upgrade is not feasible, restrict the Data Import permission to only highly trusted internal users via Frappe's Role-based permission system, which removes the authenticated entry point; note this may disrupt bulk-import workflows. A Content Security Policy header that disallows inline scripts can limit the blast radius of any stored payload but does not eliminate the stored content and may break other Frappe UI components - evaluate against your deployment before applying.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today