{"id":"CVE-2026-39375","kind":"vulnerability","aliases":["CVE-2026-39375"],"related":[],"title":"Frappe LMS: stored script injection through course meta tag fields","description":"Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.","summary":"Frappe Learning Management System stores course meta tag values without proper HTML sanitization and renders them unescaped. A user with a course editing role can plant JavaScript that runs in other users' browsers.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frappe","frappe-lms","runtime","self-hosted"],"not_affected_if":["no-course-editing-roles","version-2.52.0-or-later"],"how_to_check":"- Check the installed Frappe LMS version, for example with `bench version` or the app's version in the site settings.\n- Look for course meta tag fields in the Course Management module that accept raw HTML or script.","fix":"- Frappe LMS: move to `2.52.0` or later.","status":"open","published_at":"2026-10-30T17:17:23+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:18+00:00","updated_at":"2026-10-30T17:32:18+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-30T17:32:18Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe LMS: move to `2.52.0` or later.","reach":"network","title":"Frappe LMS: stored script injection through course meta tag fields","impact":"medium","summary":"Frappe Learning Management System stores course meta tag values without proper HTML sanitization and renders them unescaped. A user with a course editing role can plant JavaScript that runs in other users' browsers.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frappe-lms","self-hosted","frappe"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in other users' browsers, possibly stealing their sessions.","analyst_note":"","how_to_check":"- Check the installed Frappe LMS version, for example with `bench version` or the app's version in the site settings.\n- Look for course meta tag fields in the Course Management module that accept raw HTML or script.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.52.0-or-later","no-course-editing-roles"],"who_is_affected":"Sites running Frappe LMS before 2.52.0 where users hold a course editing role can store malicious script through meta tag fields. The script runs for anyone who later views the affected course page, so staff and learners using the portal are the people exposed. Installations with no course editors, or with only trusted editors, carry less risk but should still upgrade.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4153,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-39375':13A,16A '2.52.0':76C,125C 'adequ':103C 'allow':113C 'authent':78C 'browser':57B 'content':72C 'cours':7A,30B,46B,82C,95C 'cross':116C 'cross-sit':115C 'cve':11A,14A 'edit':47B,83C 'escap':110C 'field':10A,92C 'fix':122C 'frapp':1A,17B,19B,25B,58C 'frappe-lm':18B 'help':68C 'host':24B 'html':36B,104C 'inject':5A,86C 'issu':120C 'javascript':51B,88C 'learn':26B,59C,65C 'lms':2A,20B,62C 'malici':87C 'manag':27B,60C,96C 'meta':8A,31B,90C 'modul':97C 'plant':50B 'prior':73C 'proper':35B 'render':39B,112C 'role':48B,84C 'run':53B 'runtim':21B 'safe':109C 'sanit':37B,105C 'script':4A,118C 'self':23B 'self-host':22B 'site':117C 'store':3A,29B,101C,114C 'structur':70C 'system':28B,61C,66C 'tag':9A,32B,91C 'unescap':41B 'user':43B,56B,69C,79C 'valu':33B,99C 'version':75C,124C 'without':34B,102C","nicknames":[],"mitigations":[],"who_affected":"Sites running Frappe LMS before 2.52.0 where users hold a course editing role can store malicious script through meta tag fields. The script runs for anyone who later views the affected course page, so staff and learners using the portal are the people exposed. Installations with no course editors, or with only trusted editors, carry less risk but should still upgrade.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39375","severity":null,"published_at":"2026-10-30T17:17:23+00:00","modified_at":"2026-10-30T17:17:23+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}