CVE-2023-54408

6.1Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Attackers can execute malicious JavaScript in victims' browsers to hijack sessions or steal sensitive data. This requires an attacker to submit crafted HTML that another user subsequently views.

Root cause

Frappe inadequately escapes user-supplied content when rendering pages, allowing injected HTML and scripts to execute.

Affected systems

Frappe versions before 13.52.0 and 14.x versions before 14.31.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Frappe to version 13.52.0, 14.31.0, or newer. No workaround is documented, so patching is required.

shell

$ bench update --reset

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.

References

Source: nvd.nist.gov/vuln/detail/CVE-2023-54408