The flaw arises because the html2text helper under sanitizes user supplied HTML, allowing script tags to survive conversion. Authenticated attackers can inject crafted HTML that, when rendered in a victim’s browser, runs arbitrary JavaScript. This client‑side code execution enables defacement, session hijacking by stealing cookies, or arbitrary phishing content. The server itself is not compromised, but the vulnerability can be used to attack anyone who views the affected content.

The vulnerability affects the Frappe framework. All releases prior to version 13.46.1 in the 13.x series, and all 14.x releases before 14.20.0, are impacted. Deployments of these releases that allow arbitrary HTML to be processed by html2text are at risk.

The CVSS score of 5.9 indicates medium severity, focused on client‑side impact. EPSS is not available and the issue is not listed in CISA KEV, suggesting no known large‑scale exploitation. An attacker must first be authenticated to supply malicious HTML, and the malicious script only runs when an end‑user views the rendered content. This reduces the likelihood of exploitation but still presents a moderate risk if many users can view compromised content.