Live › vulnerability › CVE-2026-39375
Frappe Learning Management System stores course meta tag values without proper HTML sanitization and renders them unescaped. A user with a course editing role can plant JavaScript that runs in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Sites running Frappe LMS before 2.52.0 where users hold a course editing role can store malicious script through meta tag fields. The script runs for anyone who later views the affected course page, so staff and learners using the portal are the people exposed. Installations with no course editors, or with only trusted editors, carry less risk but should still upgrade.
No product ranges from the sources yet.
bench version or the app's version in the site settings.2.52.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-39375")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.