Vulnerability Description
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer's session, with the viewer's permissions. FreePBX's own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.
Related Weaknesses (CWE)
References
- https://github.com/mwtcmi/frogman/commit/f0d2ba1785abb31b7d5debeae526f9e36962b55
- https://github.com/mwtcmi/frogman/security/advisories/GHSA-7qvv-vgw9-rcxg
FAQ
What is CVE-2026-46516?
CVE-2026-46516 is a documented vulnerability. Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four ...
How severe is CVE-2026-46516?
CVSS scoring is not yet available for CVE-2026-46516. Check NVD for updates.
Is there a patch for CVE-2026-46516?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.