CVE-2026-39375
Severity not reportedFrappe Learning Management System (LMS) is a learning system that helps users structure their content.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/frappe/lms/commit/cd6aca25f7d28425660720db4fdb920727edb670 security-advisories@github.com
- https://github.com/frappe/lms/commit/f244a6c9ff6e0b104fec48b2d97af4cc09896b60 security-advisories@github.com
- https://github.com/frappe/lms/security/advisories/GHSA-9fqj-95wr-6hm6 security-advisories@github.com
- https://github.com/frappe/lms/tree/v2.52.0 security-advisories@github.com