CVE-2026-46516 Details
Description
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer's session, with the viewer's permissions. FreePBX's own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.
A stored cross-site scripting vulnerability has been identified in Frogman versions prior to 1.6.6. The issue arises in the chat console's markdown formatter, which improperly inserts user-controlled data as raw HTML in several template patterns, including inline code, bold text, markdown links, and download links. This flaw allows the injection of HTML/JavaScript payloads that execute in the session of any admin viewing the response through Frogman chat. The vulnerability exploits a lack of proper escaping in user-generated content, contrasting with FreePBX's admin GUI, which correctly sanitizes these fields. As a result, tool responses reflecting user-controlled data, such as extension names and ring-group descriptions, could trigger the execution of injected scripts when accessed by other admins via Frogman chat.
Users should update to Frogman version 1.6.6, which patches the vulnerability by ensuring that all regex captures are properly escaped before being inserted into the chat formatter. Additionally, download link URLs are now checked against a whitelist to block potentially harmful schemes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mwtcmi/frogman/commit/f0d2ba1785abb31b7d5debeae526f9e36962b55e | [email protected] | Source CodeVendor |
| https://github.com/mwtcmi/frogman/security/advisories/GHSA-7qvv-vgw9-rcxg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frogman | <= 1.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |