Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck
CVE-2023-54409Frappe before 13.46.1 XSS via html2text Weak Sanitization
Medium 4.8
In plain English
A medium-severity security flaw in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 86.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.
Affected products (as reported)
Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-wp7j-3w22-93j6) vendor-advisory
- VulnCheck Advisory: Frappe before 13.46.1 XSS via html2text Weak Sanitization third-party-advisory