PT-2026-110998

CVE-2023-54409

Published

2026-10-12

Updated

2026-10-13

Description by

CVSS 4.0

5.9

Medium

MetricsAV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0

Description Authenticated attackers can execute scripts in the browsers of users who view rendered content. This occurs because the html2text() function weakly sanitizes user-supplied HTML input, leading to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 13.46.1 or later. Update to version 14.20.0 or later. As a temporary workaround, restrict the use of the html2text() function for processing untrusted user input.

Exploitability

Exploit

Fix

Impacts

Researchers

Ankush

Maharshivpatel

Vendors

Affected products

Weakness enumeration

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Related identifiers