Live › vulnerability › CVE-2026-119144
Frappe Framework renders user-controlled message fields as templates without neutralizing them. An authenticated user with a common operational role can inject template expressions that the server evaluates in an unrestricted context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running Frappe Framework or ERPNext-style apps built on it, where users with an operational role can write message fields that get rendered as templates. Installs on the fixed versions or with no such roles in use are not exposed. The sources do not describe the exact feature path beyond message fields.
No product ranges from the sources yet.
bench version or the frappe entry in the app's requirements, and compare it to the fixed ranges.15.x line below 15.111.0 or the 16.x line below 16.21.0.15.111.0 or later on the 15 line16.21.0 or later on the 16 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.
This page as .md · .json · in your agent: get_signal("CVE-2026-119144")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.