CVE-2023-54409: Frappe before 13.46.1 XSS via html2text Weak Sanitization
Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe versions before 13.46.1 and 14.x versions before 14.20.0 are affected.
What does an attacker need to exploit this issue?
The attacker needs an authenticated Frappe account and must be able to submit crafted HTML that reaches the html2text processing path. Exploitation also requires a user to view the rendered malicious content.
What is the impact if exploitation succeeds?
Crafted content can execute scripts in the browser of a user viewing it. The reported impact is confidentiality loss; integrity and availability impact are not indicated.