EUVD-2026-45963Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because attacker must hold admin credentials to write entity fields; UI:R for victim admin who triggers rendering; S:C as payload executes in a separate admin session with its own privileges.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (assets/js/chat.js's formatMarkdown) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields - extension names, ring-group descriptions, IVR names, queue descriptions, etc. - could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer's session, with the viewer's permissions. FreePBX's own admin GUI escapes these same fields via freepbx_htmlspecialchars() throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.
AnalysisAI
Stored cross-site scripting in Frogman's chat-console markdown formatter allows a FreePBX admin with write access to entity fields (extension names, ring-group descriptions, IVR names, queue descriptions) to inject JavaScript payloads that execute in a second, higher-privileged admin's browser session when those fields are reflected through Frogman chat tool responses. All versions prior to 1.6.6 are affected; version 1.6.6, released following an internal audit on 2026-05-13, is the patching release. No public exploit code exists and no active exploitation has been confirmed (no CISA KEV listing); real-world risk is bounded by the product's experimental status and PR:H requirement.
Technical ContextAI
Frogman is a headless FreePBX control layer that surfaces an AI-driven chat console for PBX administration; the affected component is the formatMarkdown function in assets/js/chat.js, identified by CPE cpe:2.3:a:mwtcmi:frogman:*:*:*:*:*:*:*:*. The root cause (CWE-79, Improper Neutralization of Input During Web Page Generation) is that four regex substitutions - inline code, bold, markdown links, and download links - used bare regex capture group references ($1, $2) to construct HTML strings, inserting attacker-controlled content directly into the DOM without escaping. FreePBX stores admin-configurable strings in its database and the vendor's own admin GUI properly neutralizes these values via freepbx_htmlspecialchars() in view templates; Frogman's formatter was a parallel, unguarded rendering path. Because Frogman chat operates without a Content Security Policy on its DOM-construction path, escaping at the formatter layer is the correct and sufficient defensive boundary.
RemediationAI
Upgrade to Frogman version 1.6.6, which is confirmed by the module.xml diff and vendor GHSA advisory. The fix applies escapeHtml() to all four formatMarkdown substitution callbacks - inline code bodies, bold text bodies, markdown link text and URL components, and download link URL values - and adds a scheme allowlist rejecting javascript:, data:, and vbscript: URIs in download links. The patching commit is at https://github.com/mwtcmi/frogman/commit/f0d2ba1785abb31b7d5debeae526f9e36962b55e and the advisory is at https://github.com/mwtcmi/frogman/security/advisories/GHSA-7qvv-vgw9-rcxg. As a compensating control prior to patching, restrict Frogman chat access to a single trusted admin account, effectively eliminating the write-tier-to-read-tier escalation path; this trades administrative convenience for safety. Alternatively, audit oc_permissions to ensure any admin with write access to FreePBX entity fields is granted equivalent trust as the admin using Frogman chat, removing the tier separation assumption the attack depends on. Restricting lower-trust admin write access to extension names, ring-group descriptions, IVR names, and queue descriptions also eliminates injection vectors without disabling Frogman.
Code injection in Frogman before 1.6.2 lets an authenticated PERM_WRITE caller of the MCP/HTTP dialplan API inject arbit
Missing authorization in Frogman, a headless Asterisk PBX control layer exposed over MCP and an HTTP API, lets any low-p
Sensitive credential exposure in Frogman (an mwtcmi FreePBX module providing headless PBX control via MCP and an HTTP AP
Plaintext credential exposure in Frogman's audit logging pipeline allows any authenticated low-privilege user holding PE
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today