CVE-2024-58391: Frappe before 15.4.0 XSS via Printview Parameters

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-13
Weakness: CWE-79

Description

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session.

Affected products

frappe: before 14.58.0; from 15.0.0 before 15.4.0 — fixed in 14.58.0, 15.4.0

How to fix

Upgrade to a fixed version: frappe 14.58.0, 15.4.0. Check the vendor advisory for mitigations.

References

https://github.com/frappe/frappe/security/advisories/GHSA-v248-pv3c-jvgw
https://www.vulncheck.com/advisories/frappe-before-15.4.0-xss-via-printview-parameters

Get alerted when CVE-2024-58391 or the next vulnerability affects your stack