Cross-Site Scripting in Frappe Framework Affects Data Import Functionality

CVE-2026-49391

What is CVE-2026-49391?

The Frappe Framework, a robust web application development platform, was found to have a vulnerability involving improper handling of data imports. Specifically, prior versions (before 16.19.0 and 15.109.0) allowed authenticated users to import column headers that included script content. This content could persist and execute when another user accessed the import interface rendering the application susceptible to Cross-Site Scripting (XSS) attacks. It is essential for users to upgrade to the fixed versions to mitigate this risk.

References