All vulnerabilities
CVE-2026-55823GHSA-mf6r-q34j-pjw7

Frappe: Possibility of SQL injection in reportview

frappe frappe
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16.23.0Fixed versionGitHub
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.

Text from CVE List

Affected versions 2

  • frappeaffected: < 16.23.0CVE List
  • frappe, pip<16.23.0GitHub

References 6