CVE-2026-31877
Published: 11 March 2026
Summary
CVE-2026-31877 is a critical-severity SQL Injection (CWE-89) vulnerability in Frappe Frappe. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31877 is a SQL injection vulnerability (CWE-89) affecting Frappe, a full-stack web application framework. Versions prior to 15.84.0 and 14.99.0 are vulnerable, where a specially crafted request to a certain endpoint allows attackers to execute arbitrary SQL queries. The issue has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation.
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required. Successful exploitation enables attackers to extract sensitive information from the database that would otherwise be inaccessible, potentially compromising confidentiality, integrity, and availability of affected systems.
The official GitHub security advisory (GHSA-2c4m-999q-xhx4) confirms the vulnerability and states it is fixed in Frappe versions 15.84.0 and 14.99.0. Security practitioners should upgrade to these patched versions immediately to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11288
Vulnerability details
Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. This vulnerability…
more
is fixed in 15.84.0 and 14.99.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing Frappe web framework directly enables remote unauthenticated exploitation (T1190); arbitrary SQL queries facilitate collection/manipulation of database contents (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, prioritization, and remediation of the SQL injection flaw through patching to Frappe versions 15.84.0 or 14.99.0.
Prevents SQL injection exploitation by enforcing validation of untrusted inputs to the vulnerable web application endpoint using organization-defined tools and procedures.
Boundary protection with web application firewalls inspects and blocks crafted requests containing SQL injection payloads targeting the endpoint.