Vulnerabilities CVE-2026-49391

CVE-2026-49391

Medium

Open

TLP:CLEAR

Frappe: Stored XSS in Column Headers via Data Import

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.

Details

CVSS Score: 5.1
EPSS Score ⓘ: 0.34%

27th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Confidence: 90%
Published: Aug 6, 2026
Last Modified: Aug 7, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.