CVE-2023-54409 in Frappe
Summary
by MITRE • 10/13/2026
Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe framework, specifically affecting versions prior to 13.46.1 and version 14.x prior to 14.20.0. This vulnerability is classified as a Cross-Site Scripting (XSS) issue stemming from inadequate input sanitization mechanisms embedded in the html2text conversion function. The core technical deficiency lies in how the framework processes HTML content during its transformation into plain text format. Instead of employing a robust, whitelist-based filtering strategy or utilizing established secure libraries for HTML parsing and cleaning, the implementation relies on weak regex patterns or incomplete logic that fails to strip out potentially malicious script tags, event handlers, or other executable code constructs embedded within user-supplied input. This oversight allows attackers who have successfully authenticated into the application to inject crafted HTML payloads that bypass the sanitization layer.
From an operational perspective, this vulnerability enables stored cross-site scripting attacks when the tainted content is rendered for other users. Because Frappe is often used as a backend framework for web applications handling sensitive business data, the impact of such an attack can be severe. An authenticated attacker does not need to trick a user into clicking a malicious link; rather, they simply need to input the crafted HTML payload through any field that utilizes this html2text function and triggers its rendering in another user's browser session. When a victim views the affected content, their browser executes the injected scripts within the context of the application’s domain. This allows the attacker to perform actions on behalf of the victim, steal session cookies or authentication tokens, capture keystrokes, or redirect the user to malicious external sites designed for phishing or further malware distribution.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. More specifically, it falls under CWE-836 where the application uses a password or similar value for authorization purposes but fails to properly validate input before processing, leading to unintended code execution in this context due to insufficient sanitization. In terms of the MITRE ATT&CK framework, this exploit technique maps to T1059 Command and Scripting Interpreter via browser-based scripting, specifically leveraging stored XSS vectors as described in sub-technique T1059.007 or potentially T1189 Drive-by Compromise if used for initial access through social engineering of other users viewing the content. The attack vector is classified as Network with Authentication Required (T1190), indicating that an attacker must first gain valid credentials to leverage this flaw effectively, which mitigates remote unauthenticated exploitation but does not prevent insider threats or compromised account abuse.
To mitigate this vulnerability, organizations running Frappe versions prior to 13.46.1 and 14.x before 14.20.0 should immediately upgrade to the latest patched releases where these sanitization issues have been addressed by the development team. If upgrading is not immediately feasible, administrators can implement a compensating control by configuring Content Security Policy (CSP) headers on their web servers or application proxies. A strict CSP that restricts script execution sources and disables inline scripts can significantly reduce the impact of any successfully injected XSS payloads. Additionally, developers should review custom integrations using the html2text function to ensure they are not relying solely on this method for security-critical input validation without additional server-side sanitization layers such as OWASP Java Encoder or equivalent libraries in other languages that provide comprehensive HTML entity encoding and tag stripping capabilities. Regular security audits of third-party dependencies and framework updates remain critical to maintaining the integrity of web applications built on Frappe.