PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46516 mwtcmi CVE debrief

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer's session, with the viewer's permissions. FreePBX's own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.

Vendor
mwtcmi
Product
frogman
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-20
Advisory published
2026-07-20
Advisory updated
2026-07-20

Who should care

Administrators using Frogman for headless FreePBX control, especially those with multiple administrators accessing the chat console, should be aware of this vulnerability. They should ensure that the patched version, 1.6.6 or later, is installed to prevent potential JavaScript payload execution.

Technical summary

The Frogman chat-console markdown formatter, located in `assets/js/chat.js` under the function `formatMarkdown`, improperly handled user-controlled input by inserting regex capture groups as raw HTML. This allowed for potential JavaScript payload execution when an administrator views a response through Frogman chat. The vulnerability was addressed in version 1.6.6. Affected product deployments should be reviewed for exposure, and administrators should ensure proper input validation and sanitization for user-controlled fields. The chat formatter's improper handling of user input could lead to JavaScript execution in the context of an administrator's session, potentially allowing attackers to perform actions with the viewer's permissions.

Defensive priority

Medium priority should be given to patching Frogman installations, as the vulnerability allows for JavaScript execution in the context of an administrator's session.

Recommended defensive actions

  • Patch Frogman to version 1.6.6 or later
  • Review and monitor chat console interactions for suspicious activity
  • Ensure proper input validation and sanitization for user-controlled fields
  • Consider implementing additional security measures, such as Content Security Policy (CSP)
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T15:16:38.833Z and was last modified on 2026-07-20T19:17:23.220Z. The NVD entry is currently available. Evidence of the vulnerability's existence and impact is limited to the information provided in the CVE and NVD records. Defenders should verify the patched version, 1.6.6 or later, is installed and review chat console interactions for suspicious activity. Additional security measures, such as Content Security Policy (CSP), may be considered to mitigate potential risks.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T15:16:38.833Z and has not been modified since then.