Description
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.
Published: 2026-08-06
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authenticated user with data import privileges can include arbitrary script code in column header names. Because the framework does not escape these headers when rendering import previews or results, the script executes in the browser of any user who subsequently views the affected interface, resulting in a stored cross‑site scripting vulnerability.

Affected Systems

Frappe framework is affected. Any installation running a version earlier than 16.19.0 or 15.109.0 is vulnerable. The weakness exists in the Data Import functionality across these releases.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is exploitable by an authenticated importer; any subsequent user who views the import preview or results can be impacted. The attack vector is a stored cross‑site scripting through unsanitized data import headers.

Generated by OpenCVE AI on August 7, 2026 at 00:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Frappe to version 16.19.0 or 15.109.0 or later where this issue is resolved
  • If an upgrade cannot be performed immediately, restrict the Data Import permission to trusted users only, preventing untrusted accounts from creating potentially malicious imports
  • Apply a temporary patch by escaping or sanitizing column header values before rendering them in the import preview or results to mitigate the XSS effect

Generated by OpenCVE AI on August 7, 2026 at 00:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Frappe
Frappe frappe
Vendors & Products Frappe
Frappe frappe

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.
Title Frappe: Stored XSS in Column Headers via Data Import
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Frappe Frappe
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-07T17:21:30.582Z

Reserved: 2026-05-29T19:08:01.256Z

Link: CVE-2026-49391

cve-icon Vulnrichment

Updated: 2026-08-07T17:21:27.367Z

cve-icon NVD

Status : Received

Published: 2026-08-06T22:17:14.360

Modified: 2026-08-07T18:17:18.550

Link: CVE-2026-49391

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T00:45:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')