CVE-2026-46516

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46516
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46516.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46516
Aliases
  • GHSA-7qvv-vgw9-rcxg
Published
2026-07-20T14:23:23.073Z
Modified
2026-07-22T05:32:40.172480232Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)
Details

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (assets/js/chat.js's formatMarkdown) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer's session, with the viewer's permissions. FreePBX's own admin GUI escapes these same fields via freepbx_htmlspecialchars() throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46516.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/mwtcmi/frogman

Affected ranges

Type
GIT
Repo
https://github.com/mwtcmi/frogman
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f0d2ba1785abb31b7d5debeae526f9e36962b55e
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46516.json"