CVE-2026-46546 Frappe LMS: HTML injection in user-controlled metadata
Authenticated users can inject HTML into metadata fields, causing visitors to be redirected to attacker-controlled URLs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-46546?
CVE-2026-46546 is a low-severity cross-site scripting vulnerability in frappe lms, published on 9 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could supply specially crafted content in certain user-editable fields that, when surfaced in page metadata, caused visitors' browsers to navigate to an attacker-chosen URL. This issue has been patched in version 2.53.0.
Which versions are affected by CVE-2026-46546?
It affects 1 product.
Products include Frappe Learning.
How do I fix CVE-2026-46546?
No fix has been published for CVE-2026-46546 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-46546 being exploited?
There is no known exploitation of CVE-2026-46546 in the wild and no public exploit code.
Other vulnerabilities in frappe lms
- CVE-2023-5555 Cross-site Scripting (XSS) - Generic in frappe/lms
- CVE-2026-34606 Stored XSS in Frappe LMS
- CVE-2026-26977 Frappe Learning Management System exposes details of unpublished courses to unauthorized users
- CVE-2025-11280 Frappe LMS Assignment Picture files direct request
- CVE-2023-42807 Frappe LMS SQL Injection Issue on People Page
Sources
Also known as GHSA-2x47-gr9q-w6fv.