CVE-2026-46546 is an injection vulnerability in Frappe LMS that allows an authenticated user to supply crafted input in certain user-editable fields. This input is improperly neutralized and subsequently included in page metadata, leading to unintended browser navigation for visitors. The vulnerability affects all versions prior to 2.53.0 and has been patched in 2.53.0. The CVSS 4.0 base score is 2.1, indicating low severity, with attack vector network, low attack complexity, partial user interaction, and limited impact on confidentiality and integrity.

An attacker with authenticated access can cause visitors to the affected LMS pages to be redirected to attacker-chosen URLs by injecting malicious content into page metadata. This could be used for phishing or redirecting users to malicious sites. The impact is limited by the requirement for attacker authentication and partial user interaction. There is no indication of confidentiality, integrity, or availability compromise beyond the redirect behavior.

Upgrade Frappe LMS to version 2.53.0 or later, where this vulnerability has been patched. Since the vendor has released a fixed version, applying this official fix is the recommended remediation. No additional mitigation steps are specified or required beyond updating to the patched version.