CVE-2026-31877 is a SQL injection in the Frappe web application framework. NVD scores it 9.8 critical, while the project's own advisory rates it moderate. A specially crafted request to a certain endpoint can let an attacker extract data. Upgrade to Frappe 15.84.0 or 14.99.0, or later.
What's affected
Frappe versions before 15.84.0 on the version 15 line, and before 14.99.0 on the version 14 line. The advisory lists those as the patched releases.
Frappe underpins other products, including ERPNext. Anything built on a vulnerable Frappe version inherits the exposure, so check the framework version rather than only the application name.
The advisory does not name the endpoint, and I will not guess at it. The maintainers say upgrading is required, so there is no configuration workaround to rely on.
How to check if you're exposed
On a bench based install, run this from the bench directory to list app versions.
bench version
Look at the version reported for frappe and compare it with 15.84.0 and 14.99.0. For containers, read the image tag you deploy. If you install with pip, pip show frappe prints the installed version.
What to do now
- Upgrade Frappe to 15.84.0 or later, or 14.99.0 or later, depending on your line.
- Run your usual migration and test steps for the apps built on Frappe before you go live.
- Check web and database logs for unusual requests around the disclosure date, March 2026.
- Restrict direct internet access to administration interfaces while you schedule the upgrade.
Why it matters
The class is CWE-89. Untrusted input reached a database query in a way that let it change the structure of the statement. The advisory describes the result as information extraction, so confidentiality is the main concern.
The two ratings disagree for a reason you can use. NVD assumes a network attack with no privileges needed. The maintainers rated it lower, probably on how they see the endpoint being reached. Neither source is wrong enough to ignore the fix. When a framework underlies business systems, a data extraction flaw is worth patching on the normal fast track.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do NVD and the advisory disagree on severity?
NVD scored it 9.8 using generic network assumptions. The maintainers rated it moderate. Both agree the fix is to upgrade.
Does this affect ERPNext?
ERPNext is built on Frappe, so check the Frappe version it runs. The advisory itself names Frappe only.
Sources
Last reviewed: 19 October 2026.
