CVE-2025-62779: Frappe Learning XSS Vulnerability

CVE-2025-62779 Overview

CVE-2025-62779 is a stored Cross-Site Scripting (XSS) vulnerability in Frappe Learning, an open source learning management system. In versions 2.39.1 and earlier, the Job Form allows users to submit HTML content through input fields without proper sanitization. The unescaped input is later rendered in the browser, enabling script injection into pages viewed by other users. The issue is tracked under CWE-79 and was patched in the upstream repository.

Critical Impact
Authenticated users can inject HTML or JavaScript through Job Form fields, which executes in the context of other users viewing the affected job listings.

Affected Products

Frappe Learning 2.39.1
Frappe Learning versions prior to 2.39.1
Frappe LMS deployments using the vulnerable JobCard.vue and JobForm.vue components

Discovery Timeline

2025-10-27 - CVE-2025-62779 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62779

Vulnerability Analysis

The vulnerability resides in the Job Form feature of Frappe Learning. Input fields on the form accept HTML markup and store it in the backend without sanitization. When another user views the job listing, the Vue.js frontend renders the stored content without escaping, allowing injected markup and scripts to execute. Exploitation requires an authenticated account with permission to submit a job posting, plus a victim interacting with the rendered content.

The impact is bounded to the browser context of users viewing job listings. An attacker can steal session data accessible to the frontend, perform actions on behalf of the victim, or redirect users to attacker-controlled resources. The EPSS probability of 0.172% (percentile 6.84) reflects low observed exploitation interest.

Root Cause

The root cause is missing output encoding in the Vue components responsible for rendering job data. The frontend utility module exposes an escapeHTML helper, but JobForm.vue did not import or invoke it against user-supplied fields before storage or render. The JobCard.vue template additionally rendered long unbroken strings without CSS containment, contributing to layout-based injection surface.

Attack Vector

An authenticated user with access to the Job Form submits values containing HTML or JavaScript payloads through form fields such as company name or job description. The payload is persisted server-side and later rendered when any user browses the job listing. Because the injection is stored, the attacker does not need to deliver a crafted link to the victim.

text

# Patch excerpt: frontend/src/components/JobCard.vue
 		class="flex flex-col border rounded-md p-3 h-full hover:border-outline-gray-3"
 	>
 		<div class="flex space-x-4 mb-4">
-			<div class="flex flex-col space-y-2 flex-1">
+			<div class="flex flex-col space-y-2 flex-1 break-all">
 				<div class="text-lg font-semibold text-ink-gray-9">
 					{{ job.company_name }}
 				</div>

# Patch excerpt: frontend/src/pages/JobForm.vue
-import { getFileSize, validateFile } from '@/utils'
+import { escapeHTML, getFileSize, validateFile } from '@/utils'

Source: Frappe LMS commit 75001b4

Detection Methods for CVE-2025-62779

Indicators of Compromise

Job Form submissions containing HTML tags such as <script>, <img onerror=...>, or <iframe> in fields like company_name, job_title, or description
Outbound requests from user browsers to unfamiliar domains immediately after loading a job listing page
Session tokens or CSRF tokens appearing in web server referer or query logs for external destinations

Detection Strategies

Review the Frappe Learning database for stored Job records containing HTML control characters or javascript: URIs in user-editable fields
Deploy web application firewall rules that flag HTML tags in POST bodies targeting the Job Form endpoint
Correlate authenticated user activity with anomalous DOM script execution reported by browser telemetry

Monitoring Recommendations

Enable audit logging for all Job Form create and update operations, capturing the submitting user and raw field values
Monitor Content Security Policy (CSP) violation reports for script-src blocks on Job listing pages
Alert on unusual privilege changes or session activity following a user's visit to a Job listing view

How to Mitigate CVE-2025-62779

Immediate Actions Required

Upgrade Frappe Learning to a version later than 2.39.1 that includes commit 75001b4
Audit existing Job records and strip HTML from historical entries submitted prior to patching
Restrict Job Form submission permissions to trusted user roles until the patch is applied

Patch Information

The fix is committed to the Frappe LMS repository in commit 75001b494d5d8198eab20b0cd85d5bd719448ea3. The patch imports the escapeHTML utility into JobForm.vue and applies break-all styling in JobCard.vue. Refer to GitHub Security Advisory GHSA-j6h8-qg65-3fpx for the upstream disclosure.

Workarounds

Apply a reverse-proxy Content Security Policy that disables inline script execution on Frappe Learning pages
Temporarily disable the Jobs module or remove user permissions to create Job records until upgrade is complete
Sanitize existing Job field data at the database layer using an HTML-stripping routine

bash

# Verify installed Frappe Learning version and pull the patched release
bench --site <site-name> list-apps | grep lms
cd apps/lms && git fetch origin && git checkout 75001b494d5d8198eab20b0cd85d5bd719448ea3
bench --site <site-name> migrate
bench build --app lms
bench restart