Servers and applications

GHSA-vp4r-5v6w-r962

Blind SQL Injection via X-Frappe-Request-Id header

Severity: High 8.2
Published: 12 Nov 2026
Last changed: 12 Nov 2026
Added to UpHeron: 12 Nov 2026
Fixed in: 15.120.0, 16.33.0
Weakness: SQL injection (CWE-89)
Attack: Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can: Read data
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Sources: Project advisories (GitHub)

Description

Blind SQLi attack is possible via X-Frappe-Request-Id when monitoring is enabled.

There are no workarounds. Updating to the latest versions of Frappe Framework should resolve this.

Software	Affected versions
Frappe FrameworkServers and applications · `github:frappe/frappe`	Every version before 16.33.0 Every version before 15.120.0

GitHub Advisory Database https://github.com/advisories/GHSA-vp4r-5v6w-r962
github.com https://github.com/frappe/frappe/security/advisories/GHSA-vp4r-5v6w-r962