CVE-2024-24812: Frappe

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available.

Affected products

• Frappe Frappe: before 14.59.0 (fixed in 14.59.0); from 15.0.0, before 15.5.0 (fixed in 15.5.0)

Published 2024-02-07. Last modified 2026-06-17.