CVE-2023-54409

Frappe before 13.46.1 XSS via html2text Weak Sanitization

5.9 Medium

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.22%Unchanged since Oct 13, 2026

What each source reports

CVE List Score used 5.9

Frappe before 13.46.1 XSS via html2text Weak Sanitization

Record: CVE-2023-54409
CVSS 4.0: 5.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-80
Updated: 2026-11-02

EUVDEUVD-2023-60715 5.9

Record: EUVD-2023-60715
CVSS 4.0: 5.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w4rh-867r-qwp3 5.9

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability...

Record: GHSA-w4rh-867r-qwp3
CVSS 4.0: 5.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-80
Updated: 2026-11-02

NVD 5.9

Record: CVE-2023-54409
CVSS 4.0: 5.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-80
Updated: 2026-11-02

OSV 5.9

Frappe before 13.46.1 XSS via html2text Weak Sanitization

Record: CVE-2023-54409
CVSS 4.0: 5.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-80
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-54409 is a medium vulnerability (CVSS 5.9) in Elated-themes Frappe, published October 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. No source names a fixed version.