CVE-2023-54408: Frappe before 14.31.0 HTML Injection via Weak Escaping

Q: Which Frappe versions are affected?

Frappe versions before 13.52.0 are affected, as are 14.x versions before 14.31.0.

Q: What must an attacker do to exploit this issue?

An attacker must be able to submit crafted HTML as user-supplied content. The payload is triggered when another user views a page that renders that content.

Q: Are users exposed merely by visiting an affected Frappe site?

No. Exploitation requires user interaction: a user must view a page containing the attacker-supplied content. The vulnerability can then enable cross-site scripting in that user's browser.

Published Oct 12, 2026

Updated

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.

Affected Software

1 affected component

Frappe frappe<13.52.0, >=14.0.0<14.31.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 13.52.0
Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 14.31.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Frappe versions are affected?

Frappe versions before 13.52.0 are affected, as are 14.x versions before 14.31.0.

What must an attacker do to exploit this issue?

An attacker must be able to submit crafted HTML as user-supplied content. The payload is triggered when another user views a page that renders that content.

Are users exposed merely by visiting an affected Frappe site?

No. Exploitation requires user interaction: a user must view a page containing the attacker-supplied content. The vulnerability can then enable cross-site scripting in that user's browser.

CVE-2023-54408: Frappe before 14.31.0 HTML Injection via Weak Escaping

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Frappe versions are affected?

What must an attacker do to exploit this issue?

Are users exposed merely by visiting an affected Frappe site?

Company

Resources

Contact

Frequently Asked Questions

Which Frappe versions are affected?

What must an attacker do to exploit this issue?

Are users exposed merely by visiting an affected Frappe site?