CVE-2025-59415: Frappe Learning XSS Vulnerability

CVE-2025-59415 Overview

CVE-2025-59415 is a stored Cross-Site Scripting (XSS) vulnerability in Frappe Learning, an open-source learning management system. Versions 2.34.1 and earlier fail to sanitize content uploaded to the user profile bio field. An authenticated attacker can embed malicious SVG files or unsafe HTML attributes that execute arbitrary JavaScript in the browsers of users viewing the profile. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated users can inject persistent scripts into profile bios, enabling session theft, credential harvesting, and unauthorized actions in the context of any user who views the attacker's profile.

Affected Products

Frappe Learning (LMS) versions 2.34.1 and below
Deployments serving user profile pages with unsanitized bio fields
Self-hosted and managed installations exposing the profile edit modal

Discovery Timeline

2025-09-17 - CVE-2025-59415 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59415

Vulnerability Analysis

The vulnerability resides in the Frappe LMS frontend, which renders the profile.data.bio field using Vue's v-html directive without prior sanitization. Because v-html injects raw markup into the DOM, any HTML, SVG, or script-bearing attribute stored in the bio executes when another user loads the profile page.

Malicious SVG payloads are particularly effective because SVG documents support inline <script> elements and event-handler attributes such as onload and onerror. An attacker with a valid account can update their bio through the profile edit modal, embed a crafted SVG, and wait for other users, including administrators, to trigger execution.

Root Cause

The root cause is missing output sanitization in frontend/src/pages/ProfileAbout.vue. The template bound user-controlled bio content directly to v-html, and the corresponding editor in frontend/src/components/Modals/EditProfile.vue did not filter unsafe tags or attributes on input. No allowlist of tags or attributes was enforced prior to the fix.

Attack Vector

Exploitation requires an authenticated account with permission to edit a profile. The attacker stores JavaScript inside the bio field, then relies on victim interaction — viewing the profile — to trigger the payload. Successful execution runs in the origin of the LMS, allowing session cookie theft, forced actions via CSRF-authenticated requests, and phishing overlays.

text

// Patch: frontend/src/pages/ProfileAbout.vue
<div
    v-if="profile.data.bio"
-   v-html="profile.data.bio"
+   v-html="
+       DOMPurify.sanitize(decodeEntities(profile.data.bio), {
+           ALLOWED_TAGS: [
+               'b', 'i', 'em', 'strong', 'a', 'p', 'br',
+               'ul', 'ol', 'li', 'img',
+           ],
+           ALLOWED_ATTR: ['href', 'target', 'rel', 'src'],
+       })
+   "
></div>
// Source: https://github.com/frappe/lms/commit/ed162e254690772365d4d1365f176b59bc4db72d

The fix introduces DOMPurify.sanitize() with a strict tag and attribute allowlist. Tags such as <script>, <svg>, <iframe>, and event-handler attributes are stripped before the bio reaches the DOM.

Detection Methods for CVE-2025-59415

Indicators of Compromise

Profile bio fields containing <script>, <svg>, <iframe>, or on* event handler attributes
SVG file uploads referenced from bio content with embedded JavaScript
Unexpected outbound requests from user browsers to attacker-controlled domains after loading profile pages
Session tokens or API keys appearing in web server access logs as query parameters

Detection Strategies

Query the Frappe database for tabUser Profile or equivalent tables and flag bio values matching regex patterns for HTML script content or event handlers
Enable Content Security Policy (CSP) reporting to capture inline script violations originating from /profile/* routes
Review web server logs for POST requests to profile update endpoints containing encoded <script> or javascript: payloads

Monitoring Recommendations

Alert on anomalous DOM script execution reported by CSP violation endpoints
Track file uploads with Content-Type: image/svg+xml and inspect them for inline JavaScript
Monitor for privilege escalation events immediately following administrator visits to arbitrary user profiles

How to Mitigate CVE-2025-59415

Immediate Actions Required

Upgrade Frappe Learning to a version above 2.34.1 that includes commit ed162e2
Audit existing user profile bio fields for embedded HTML, SVG, or JavaScript and sanitize or clear affected records
Enforce a restrictive Content Security Policy that disallows inline scripts and untrusted script sources

Patch Information

The vendor released a fix in the Frappe LMS repository. The patch imports DOMPurify and restricts allowed tags to formatting elements plus links and images, with attributes limited to href, target, rel, and src. Refer to the GitHub Security Advisory GHSA-h7gh-3vq5-96jx and the remediation commit for details.

Workarounds

Temporarily disable rendering of the profile bio field until the patch is applied
Restrict profile edit permissions to trusted roles to limit the attacker population
Deploy a reverse-proxy WAF rule that strips <script>, <svg>, and event-handler attributes from profile update payloads

bash

# Example CSP header to block inline script execution in Frappe LMS
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;