Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31877Frappe SQL Injection due to improper field sanitization

Critical 9.3

In plain English

A critical-severity SQL injection in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.3%top 74.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability is fixed in 15.84.0 and 14.99.0.

Affected products (as reported)

Vendor	Product	Versions
frappe	frappe	>= 15.0.0, < 15.84.0< 14.99.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/frappe/frappe/security/advisories/GHSA-2c4m-999q-xhx4 x_refsource_CONFIRM