CVE-2023-54409: Frappe before 13.46.1 XSS via html2text Weak Sanitization

Q: Which deployments are affected?

Frappe versions before 13.46.1 and 14.x versions before 14.20.0 are affected.

Q: What does an attacker need to exploit this issue?

The attacker needs an authenticated Frappe account and must be able to submit crafted HTML that reaches the html2text processing path. Exploitation also requires a user to view the rendered malicious content.

Q: What is the impact if exploitation succeeds?

Crafted content can execute scripts in the browser of a user viewing it. The reported impact is confidentiality loss; integrity and availability impact are not indicated.

Published Oct 12, 2026

Updated

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.

Affected Software

1 affected component

Frappe frappe<13.46.1, >=14.0.0<14.20.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe versions before 13.46.1 and 14.x versions before 14.20.0 are affected.

What does an attacker need to exploit this issue?

The attacker needs an authenticated Frappe account and must be able to submit crafted HTML that reaches the html2text processing path. Exploitation also requires a user to view the rendered malicious content.

What is the impact if exploitation succeeds?

Crafted content can execute scripts in the browser of a user viewing it. The reported impact is confidentiality loss; integrity and availability impact are not indicated.

CVE-2023-54409: Frappe before 13.46.1 XSS via html2text Weak Sanitization

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?