CVE-2026-49391

Received Received - Intake

Stored XSS in Frappe Framework via Data Import

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-49391

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	to 15.109.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in Frappe allows an authenticated user to import data with malicious script content in column headers. When another user views the import interface, the script executes due to unescaped rendering of these headers.

Detection Guidance

To detect this vulnerability, check the version of Frappe installed on your system. If it is below 16.19.0 or 15.109.0, the system is vulnerable. Run the command 'bench version' in your Frappe environment to check the installed version.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Users viewing the import interface may have their browsers compromised.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information.

Mitigation Strategies

Update Frappe to version 16.19.0 or later if using Frappe 16.x, or to version 15.109.0 or later if using Frappe 15.x. This fixes the issue by properly escaping column headers in Data Import.

Hi! I’m here to help you understand CVE-2026-49391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70