What is GHSA-w4rh-867r-qwp3?

GHSA-w4rh-867r-qwp3 is a security advisory published by GitHub Security Advisories with Medium severity. Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability...

Which CVE IDs does GHSA-w4rh-867r-qwp3 cover?

GHSA-w4rh-867r-qwp3 covers the following CVE IDs: CVE-2023-54409. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w4rh-867r-qwp3?

GHSA-w4rh-867r-qwp3 has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-w4rh-867r-qwp3MediumCVSS 4.8

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability...

Vendor

GitHub Security Advisories

Published

October 13, 2026

Last Modified

October 13, 2026

🔗 CVE IDs covered (1)

CVE-2023-54409 →

📋 Description

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.

🔗 References (4)

https://github.com/frappe/frappe/security/advisories/GHSA-wp7j-3w22-93j6
https://nvd.nist.gov/vuln/detail/CVE-2023-54409
https://www.vulncheck.com/advisories/frappe-before-13.46.1-xss-via-html2text-weak-sanitization
https://github.com/advisories/GHSA-w4rh-867r-qwp3