From a5e4ec654d04cad2b1b38183cd5ff383f442a530 Mon Sep 17 00:00:00 2001
From: Shrihari Mahabal <shriharimahabal08@gmail.com>
Date: Mon, 30 Mar 2026 16:20:39 +0530
Subject: [PATCH] fix(security): escape 'key' parameter in complete signup

---
 frappe/www/complete_signup.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frappe/www/complete_signup.html b/frappe/www/complete_signup.html
index db27ee9aeb..08b4428a49 100644
--- a/frappe/www/complete_signup.html
+++ b/frappe/www/complete_signup.html
@@ -5,7 +5,7 @@
 	<form role="form form-signin" method="POST"
         action="/api/method/frappe.templates.pages.login.login_oauth_user">
 		<h3 class="form-signin-heading mb-4">{{ _("One Last Step") }}</h3>
-        <input type="hidden" name="key" value="{{ frappe.form_dict.key }}">
+        <input type="hidden" name="key" value="{{ frappe.form_dict.key | e }}">
 		<div class="form-group">
 			<input type="email" name="email_id"
 				class="form-control" placeholder="{{ _('Email Address') }}" required autofocus>