CVE-2026-47739: Frappe: Stored XSS in Note

Q: What is the severity of CVE-2026-47739?

The severity of CVE-2026-47739 is classified as medium with a score of 6.9.

Q: How do I fix CVE-2026-47739?

To fix CVE-2026-47739, upgrade to Frappe versions 15.106.0 or 16.16.0 or later.

Q: What is CVE-2026-47739 related to?

CVE-2026-47739 is related to stored cross-site scripting (XSS) vulnerabilities in Frappe.

Q: What versions of Frappe are affected by CVE-2026-47739?

Frappe versions prior to 15.106.0 and 16.16.0 are affected by CVE-2026-47739.

Q: When was CVE-2026-47739 published?

CVE-2026-47739 was published on June 12, 2026.

Published Jun 12, 2026

Updated

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0.

Affected Software

1 affected component

pypi/frappe<15.106.0, <16.16.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 15.106.0
Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 16.16.0

Event History

Jun 12, 2026

CVE Published

via MITRE·02:22 PM

Data Sourced

via MITRE·02:22 PM

DescriptionWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-47739?

The severity of CVE-2026-47739 is classified as medium with a score of 6.9.

How do I fix CVE-2026-47739?

To fix CVE-2026-47739, upgrade to Frappe versions 15.106.0 or 16.16.0 or later.

What is CVE-2026-47739 related to?

CVE-2026-47739 is related to stored cross-site scripting (XSS) vulnerabilities in Frappe.

What versions of Frappe are affected by CVE-2026-47739?