Vulnerability Description
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.
Related Weaknesses (CWE)
References
- https://github.com/frappe/frappe/commit/002a36a2668781366e4bf1ff144da5e53446f540
- https://github.com/frappe/frappe/commit/2bf7b9d0b4c7f815de1c85695e9a027ecce8bed9
- https://github.com/frappe/frappe/security/advisories/GHSA-7f28-gm9h-q6rg
FAQ
What is CVE-2026-49391?
CVE-2026-49391 is a documented vulnerability. Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated im...
How severe is CVE-2026-49391?
CVSS scoring is not yet available for CVE-2026-49391. Check NVD for updates.
Is there a patch for CVE-2026-49391?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.