CVE-2026-49391: Frappe: Stored XSS in Column Headers via Data Import
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 16.19.0 - Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 15.109.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49391?
CVE-2026-49391 has a risk score of 33.
How do I fix CVE-2026-49391?
To fix CVE-2026-49391, upgrade to Frappe versions 16.19.0 or 15.109.0 or later.
What types of attacks does CVE-2026-49391 allow?
CVE-2026-49391 allows for stored cross-site scripting (XSS) attacks.
Who is affected by CVE-2026-49391?
CVE-2026-49391 affects users of the Frappe framework using vulnerable versions prior to 16.19.0 and 15.109.0.
What are the implications of CVE-2026-49391?
CVE-2026-49391 allows an authenticated user to execute arbitrary scripts on behalf of other users when they view the import interface.