CVE-2023-54409

4.8Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.8Medium

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Required
Impact: High impact on confidentiality
Weakness: CWE-80

Impact

Authenticated attackers can run arbitrary scripts in the browsers of users who view malicious rendered content, potentially stealing session data. They need valid credentials to input crafted HTML and a victim to view the output.

Root cause

The html2text function fails to properly sanitize user-supplied HTML before conversion and rendering.

Affected systems

Frappe versions prior to 13.46.1 and 14.x versions prior to 14.20.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Frappe to version 13.46.1, 14.20.0, or newer; no interim workaround is documented.

shell

$ bench update --apps frappe

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.

References

Source: nvd.nist.gov/vuln/detail/CVE-2023-54409