CVE-2026-39375

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.

References

https://github.com/frappe/lms/tree/v2.52.0

https://github.com/frappe/lms/security/advisories/GHSA-9fqj-95wr-6hm6

https://github.com/frappe/lms/commit/f244a6c9ff6e0b104fec48b2d97af4cc09896b60

https://github.com/frappe/lms/commit/cd6aca25f7d28425660720db4fdb920727edb670

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4