---
id: "CVE-2026-39375"
kind: "vulnerability"
aliases: ["CVE-2026-39375"]
title: "Frappe LMS: stored script injection through course meta tag fields"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["frappe", "frappe-lms", "runtime", "self-hosted"]
not_affected_if: ["no-course-editing-roles", "version-2.52.0-or-later"]
published_at: "2026-10-30T17:17:23+00:00"
first_seen_at: "2026-10-30T17:31:39+00:00"
updated_at: "2026-10-30T17:32:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39375", "first_seen_at": "2026-10-30T17:31:39+00:00"}]
---

# Frappe LMS: stored script injection through course meta tag fields

Frappe Learning Management System stores course meta tag values without proper HTML sanitization and renders them unescaped. A user with a course editing role can plant JavaScript that runs in other users' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Frappe LMS version, for example with `bench version` or the app's version in the site settings.
- Look for course meta tag fields in the Course Management module that accept raw HTML or script.

## Fix

- Frappe LMS: move to `2.52.0` or later.

## Timeline

- 2026-10-30T17:31:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39375

## From the sources

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_