by Kastro
Paper/Archive/CVE-2026-31877

CVE-2026-31877

frappe frappe — Frappe SQL Injection due to improper field sanitization

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 22.4.224 × 204.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.

Affected

ProductAffectedFixed inSource
frappe>= 15.0.0, < 15.84.0–CNA
frappe< 14.99.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/frappe/frappe/security/advisories/GHSA-2c4m-999q-xhx4