CVE-2026-46546 — Frappe LMS: HTML injection in user-controlled metadata

CVE-2026-46546

Frappe LMS: HTML injection in user-controlled metadata PUBLISHED

Description (CNA)

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could supply specially crafted content in certain user-editable fields that, when surfaced in page metadata, caused visitors' browsers to navigate to an attacker-chosen URL. This issue has been patched in version 2.53.0.

Affected (CNA)

Vendor / product	Versions
frappe / lms	affected < 2.53.0

CWE

CWE-74

References

https://github.com/frappe/lms/security/advisories/GHSA-2x47-gr9q-w6fv

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.