CVE-2024-58391 in Frappe
Summary
by MITRE • 10/13/2026
Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe framework, specifically affecting versions prior to 14.58.0 and version 15.x prior to 15.4.0. This vulnerability is classified as a cross-site scripting issue located in the printview functionality of the application. The root cause stems from an insufficient validation or sanitization mechanism applied to parameters passed through the URL for the print view module. When these parameters are processed, they are rendered directly into the HTML output without proper escaping, allowing untrusted input to be interpreted as executable code by the victim's web browser rather than being treated as plain text data.
From a technical perspective, this represents a classic case of reflected cross-site scripting where user-controllable input is injected into an HTTP response and executed in the context of another user. An attacker can construct a malicious URL containing script payloads within the printview parameters. When a legitimate user with active authentication sessions clicks or navigates to this crafted link, their browser will parse and execute the embedded JavaScript code. This execution occurs within the security context of the Frappe application domain, granting the injected scripts full access to session cookies, local storage, and other sensitive data associated with that specific user account.
The operational impact of this vulnerability is significant due to its potential for remote exploitation without requiring prior authentication from the attacker's side, although it does require a victim to visit the malicious link while logged into the vulnerable system. Successful exploitation can lead to session hijacking, where an attacker captures the victim's session cookies and impersonates them within the application. Furthermore, attackers may use this vector to perform actions on behalf of the user, such as modifying data, exfiltrating sensitive information visible in the print view, or redirecting the user to phishing sites. This undermines the integrity and confidentiality guarantees provided by the web application.
In terms of industry standard classifications, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector corresponds to ATT&CK technique T1059.007: Command and Scripting Interpreter via JavaScript, which describes the execution of scripts within a browser environment to achieve malicious objectives such as credential theft or lateral movement within an organization's digital assets.
To mitigate this risk, organizations running affected versions of Frappe must upgrade immediately to version 14.58.0 or later for the v14 branch, and version 15.4.0 or later for the v15 branch. These releases contain patches that implement proper output encoding and input validation mechanisms within the printview module. Until an upgrade is feasible, administrators should consider implementing web application firewall rules to detect and block requests containing suspicious script patterns in URL parameters related to printing functions. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful injection by restricting the sources from which scripts are allowed to execute within the browser environment.