CVE-2023-54409

Frappe before 13.46.1 XSS via html2text Weak Sanitization

Medium5.9EPSS 0.22%

Published: 12 Oct 2026
Updated: 13 Oct 2026
Reserved: 12 Oct 2026
Assigned by: VulnCheck

Description

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.

Scores

CVSS scores of CVE-2023-54409, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium5.9	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Medium4.8	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
NVDNVD · Deferred	4.0	Medium5.9	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.22% · top 87% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (opens in a new tab)All about CWE-80 and its CVEs

Affected products

frappe · frappe
- affected < 13.46.1
- affected 14.0.0-beta.1 – < 14.20.0
- unaffected 13.46.1
- unaffected 14.20.0

References (2)

GitHub Security Advisory (GHSA-wp7j-3w22-93j6) (opens in a new tab)vendor-advisory
VulnCheck Advisory: Frappe before 13.46.1 XSS via html2text Weak Sanitization (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-54409](https://trackcve.app/badge/CVE-2023-54409.svg)](https://trackcve.app/cve/CVE-2023-54409)

Record last updated 13 Oct 2026, 13:33 UTC.