P5Verified

CVE-2023-54409: frappe 0 to before 13.46.1, 14.0.0-beta.1 to before 14.20.0

CVE-2023-54409. CVSS 3.1 base score 4.8 (GitHub Advisory Database).

Affected technology

frappe · 0 to before 13.46.1, 14.0.0-beta.1 to before 14.20.0
frappe

Description’s affected range: before 13.46.1 and 14.x before 14.20.0

Component: Not specified by the source
Function: weakly

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content. Vendor/CNA’s CVSS 4.0 assessment (base score 5.9/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 13-Oct-2026 01:49 UTC

CWE: CWE-80
CCR priority: 19.2 /100 (P5)
CVSS 3.1: 4.8 /10 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N · GitHub Advisory Database
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-13 02:51:46.931182+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-13 01:49:08.152775+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2023-54409.html