CVE-2026-31877 Frappe SQL Injection due to improper field sanitization

Critical 9.3 Published 11 Mar 2026 Updated 12 Mar 2026

An attacker can exploit improper field sanitization in Frappe to perform SQL injection and extract sensitive information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-31877?

CVE-2026-31877 is a critical SQL injection vulnerability in frappe, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.

Weakness: CWE-89

Which versions are affected by CVE-2026-31877?

It affects 1 product.

Products include Frappe Frappe.

How do I fix CVE-2026-31877?

No fix has been published for CVE-2026-31877 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-31877 being exploited?

There is no known exploitation of CVE-2026-31877 in the wild and no public exploit code.

Sources

Also known as GHSA-2c4m-999q-xhx4.