CVE-2023-54409

Deferred Deferred - Pending Action

Cross-Site Scripting in Frappe Framework

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2023-54409

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	14.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

Frappe versions before 13.46.1 and 14.x before 14.20.0 have a cross-site scripting (XSS) vulnerability. The html2text function does not properly sanitize user input, allowing authenticated attackers to inject crafted HTML that executes scripts when viewed by other users.

Detection Guidance

Detecting this vulnerability requires checking the version of Frappe installed on your system. Compare the installed version against the patched versions (13.46.1 for version 13.x and 14.20.0 for version 14.x). Use commands like 'bench version' or check the package.json file in your Frappe installation directory.

Impact Analysis

Authenticated attackers could exploit this to run malicious scripts in the browsers of users viewing the affected content. This could lead to unauthorized actions, data theft, or session hijacking for users with access to the system.

Compliance Impact

This XSS vulnerability could expose sensitive user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately update Frappe to the latest patched version (13.46.1 or 14.20.0). If updating is not possible, restrict access to authenticated users only and review user input sanitization processes. Monitor for unusual activity in logs.

Hi! I’m here to help you understand CVE-2023-54409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70