CVE-2026-39375 in LMS
Summary
by MITRE • 10/30/2026
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Frappe Learning Management System serves as a platform for structuring educational content, yet prior to the release of version 2.52.0, it contained a significant security flaw within its Course Management module. This vulnerability allows authenticated users who possess course editing privileges to inject malicious JavaScript code into meta tag fields associated with courses. The core technical issue stems from inadequate HTML sanitization during data ingestion and a failure to properly escape these values when they are subsequently rendered in the web interface. Because the system accepts user-supplied input without filtering out script tags or event handlers, an attacker can persistently store malicious payloads within the application's database through legitimate administrative functions.
This flaw constitutes a classic Stored Cross-Site Scripting vulnerability, categorized under CWE-79 in the Common Weakness Enumeration standards. Unlike reflected XSS attacks that require tricking users into clicking specific links, this stored variant persists on the server side, meaning every user who views the compromised course content will have their browser execute the injected script automatically. The operational impact is severe, as it enables attackers to hijack administrative sessions by stealing session cookies or authentication tokens displayed in plain text within the DOM. Furthermore, an attacker could manipulate the page layout to phish credentials from other users, redirect traffic to malicious sites, or perform actions on behalf of victims if those victims have higher privilege levels than the initial attacker.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques related to Collection and Credential Access, specifically through browser credential harvesting via script injection. The persistence mechanism allows for long-term compromise of user accounts without further interaction from the attacker once the payload is stored. This type of attack vector is particularly dangerous in educational platforms where trust among users is high and automated scripts may run with elevated privileges depending on how session tokens are handled by client-side applications integrated with Frappe.
To mitigate this risk, organizations must immediately upgrade to version 2.52.0 or later, which addresses the sanitization logic for meta tag fields in the Course Management module. For systems that cannot be updated instantly due to operational constraints, implementing a Web Application Firewall rule to detect and block script injection patterns in course metadata inputs can provide temporary relief. Additionally, developers should enforce strict Content Security Policy headers on all pages rendering user-generated content to restrict inline script execution even if an injection attempt succeeds. Regular security audits focusing on input validation and output encoding practices are essential to prevent similar vulnerabilities across other modules of the Frappe framework.