Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer's session, with the viewer's permissions. FreePBX's own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-46516 Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex c… https://www.cve.org/CVERecord?id=CVE-2026-46516
Post summary
The text announces CVE-2026-46516, noting that Frogman releases headless FreePBX control prior to version 1.6.6, but provides no PoC, exploit, patch, or active exploitation details.
🚨*CVE* CVE-2026-46516 Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex c… https://www.cve.org/CVERecord?id=CVE-2026-46516 ----- Traducción: CVE-2026-46516 Fro… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-46516, detailing a headless FreePBX control issue in Frogman's chat-console, and links to the CVE record, but provides no PoC, exploit, or mitigation.