UpHeron
All vulnerabilities

Servers and applications

CVE-2023-46127

Possible HTML injection by any Desk user

Severity
Medium 5.4
Published
21 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
14.49.0
Also known as
GHSA-j2w9-8xrr-7g98
Sources
NVD, Project advisories (GitHub)

Description

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · cpe:a:frappe:frappe
  • Every version before 14.49.0
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 14.49.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-46127
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-46127
  • GitHub Advisory Database https://github.com/advisories/GHSA-j2w9-8xrr-7g98
  • github.com https://github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98