CVE-2026-39375 Details
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
A stored cross-site scripting vulnerability has been identified in Frappe Learning Management System (LMS) versions prior to 2.52.0. This issue allows an authenticated user with a course editing role to inject malicious JavaScript into meta tag fields within the Course Management module. The injected values are saved without proper HTML sanitization and are not safely escaped when displayed, leading to the execution of malicious scripts.
Users can upgrade to Frappe Learning Management System version 2.52.0 or later to address this vulnerability. Instructions for downloading this version are available on the Frappe LMS GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/lms/commit/cd6aca25f7d28425660720db4fdb920727edb670 | [email protected] | Source CodeVendor |
| https://github.com/frappe/lms/commit/f244a6c9ff6e0b104fec48b2d97af4cc09896b60 | [email protected] | Source CodeVendor |
| https://github.com/frappe/lms/security/advisories/GHSA-9fqj-95wr-6hm6 | [email protected] | AdvisoryRemedyVendor |
| https://github.com/frappe/lms/tree/v2.52.0 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe Learning Management System | <= 2.51.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |