CVE-2023-54408

Deferred Deferred - Pending Action

HTML Injection in Frappe Framework

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2023-54408

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	14.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is an HTML injection issue in Frappe versions before 13.52.0 and 14.x before 14.31.0. It occurs because user-supplied content is not properly escaped when rendered in pages, allowing attackers to inject malicious HTML that bypasses weak escaping measures. This can lead to cross-site scripting (XSS) attacks where the injected code executes in the browsers of users viewing the affected pages.

Detection Guidance

To detect this vulnerability, inspect Frappe versions before 13.52.0 or 14.x before 14.31.0. Check for user-supplied content rendered in pages that may allow HTML injection. Review server logs for unusual HTML or script tags in user inputs.

Impact Analysis

If you use a vulnerable version of Frappe, attackers could exploit this to steal user sessions, perform actions on behalf of users, or deface web pages. Users viewing injected content may have their data compromised or be redirected to malicious sites without their knowledge.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's requirement for protecting personal data and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to prevent such exploits under these regulations.

Mitigation Strategies

Upgrade Frappe to version 13.52.0 or later for the 13.x branch, or 14.31.0 or later for the 14.x branch. Apply patches if available. Review and sanitize user inputs to prevent HTML injection. Monitor for suspicious activity in rendered pages.

Hi! I’m here to help you understand CVE-2023-54408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70