CVE-2023-54409

medium

Description

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.

References

https://www.vulncheck.com/advisories/frappe-before-13.46.1-xss-via-html2text-weak-sanitization

https://github.com/frappe/frappe/security/advisories/GHSA-wp7j-3w22-93j6

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60715

Details

Source: Mitre, NVD

Published: 2026-10-12

Updated: 2026-10-13

Risk Information

CVSS v2

Base Score: 4.9

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.8

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 5.9

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00224