Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-49391 Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and res… https://www.cve.org/CVERecord?id=CVE-2026-49391
Post summary
CVE-2026-49391 concerns Frappe’s Data Import component failing to escape column headers before preview rendering, exposing a potential security flaw.
🚨*CVE* CVE-2026-49391 Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and res… https://www.cve.org/CVERecord?id=CVE-2026-49391 ----- Traducción: CVE-2026-49391 Fra… http://infoflow.cloud`
Post summary
The post announces CVE-2026-49391, noting that Frappe’s data import feature fails to escape column headers before preview rendering, potentially allowing XSS. It includes a CVE record link but no PoC, exploit, or patch information.