Frappe Press possible HTML injection through SaaS Signup inputs
Priority LOW 8CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, a user could inject HTML through SaaS signup inputs. The user who injected the unsafe HTML code would only affect themselves and would not affect other users. Commit 5d118a902872d7941f099ad1fb918e2421e79ccd patches this bug.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00499 43rd percentileScored 2026-11-07
Fix Fixed press (frappe): 5d118a902872d7941f099ad1fb918e2421e79ccd
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| frappe | press | before 5d118a902872d7941f099ad1fb918e2421e79ccd | 5d118a902872d7941f099ad1fb918e2421e79ccd | Patch available | CNA |
- press Vendorfrappe Affected before 5d118a902872d7941f099ad1fb918e2421e79ccd Fixed in 5d118a902872d7941f099ad1fb918e2421e79ccd Patch available CNA
Remediation
- Fix · CNA press (frappe) Fixed in 5d118a902872d7941f099ad1fb918e2421e79ccd
Timeline
- 2026-10-02 Threatist record created from CVE-2024-49751
References
More frappe vulnerabilities
- TI-2026-28140 ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1CRITICAL 9.8
- TI-2025-40873 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
- TI-2025-40872 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
- TI-2025-40871 A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext… CVSS 3.1CRITICAL 9.8
- TI-2025-32462 In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at… CVSS 3.1HIGH 8.2
- TI-2025-32461 In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at… CVSS 3.1HIGH 8.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences