Frappe Learning Management System HTML and JavaScript Injection Vulnerability

A vulnerability allowing HTML and JavaScript injection has been identified in Frappe Learning Management System (LMS) versions prior to 2.42.0. This issue allows authenticated users to insert malicious content into description fields of the Job, Course, and Batch forms. The injected scripts are executed in the context of the user's browser who views these items.

Impact

Exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, where malicious scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an authenticated user can add malicious HTML or JavaScript into the description fields of the Job, Course, or Batch forms. Once saved, the injected scripts will execute in the browser of any user who opens these forms.

Remediation

Users can upgrade to Frappe Learning Management System version 2.42.0 or later to address this vulnerability.