Frogman, a headless FreePBX control tool, had a vulnerability in its chat-console markdown formatter (specifically in assets/js/chat.js's formatMarkdown function) that improperly neutralized input before embedding it as HTML. This affected inline code, bold text, markdown links, and download links templates. User-controlled fields such as extension names and queue descriptions could contain malicious scripts that execute when viewed by an admin in the chat interface. FreePBX's main admin GUI properly escapes these fields, but Frogman's chat formatter did not, creating a cross-site scripting risk. The vulnerability is fixed in Frogman version 1.6.6.

An attacker able to control certain user input fields can inject HTML/JavaScript payloads that execute in the context of an admin user's session when viewed in Frogman's chat console. This could lead to unauthorized actions performed with the admin's privileges. The CVSS 4.8 score reflects a medium severity with network attack vector, low complexity, and requiring high privileges and user interaction.

Upgrade Frogman to version 1.6.6 or later, where the chat-console markdown formatter properly neutralizes input to prevent XSS. No other mitigation is indicated or required as the issue is resolved in this official fix.