Loading vulnerability…
Stored XSS in Frappe LMS Profile Bio Preview
CVE-2026-34606 is a stored cross-site scripting vulnerability in Frappe Learning Management System (LMS) versions 2.27.0 through 2.47.x. Frappe LMS sanitizes submitted rich-text profile content, but its preview-generation logic subsequently passes the sanitized HTML to BeautifulSoup get_text(). This concatenates text fragments into text that is later rendered as HTML without a further sanitization or output-encoding pass. An attacker can distribute markup fragments across permitted HTML elements so that the extracted output reconstitutes an executable script element. The payload is stored in the attacker-controlled profile bio and executes when another user views the affected profile preview or profile page.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A registered low-privileged user can execute arbitrary JavaScript in the browser security context of a user who views the malicious profile. Depending on the victim's privileges and application protections, this can enable actions as the victim, access to information available to the victim, or theft or misuse of browser-accessible session material. The flaw can be used to target administrators and facilitate a chained attack against separate privileged functionality.
If you can’t patch tonight, do this now.
Until an upgrade is deployed, restrict untrusted users' ability to edit rich-text profile bios or disable profile preview rendering where feasible. Treat preview text derived from HTML as untrusted and ensure it is contextually output-encoded or sanitized again before HTML rendering.
Patch, then assume compromise.
Upgrade Frappe LMS to version 2.48.0 or later, which patches CVE-2026-34606.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.