{"id":"CVE-2026-65974","aliases":["EUVD-2026-60451","GHSA-w996-r7v3-87wr"],"status":"published","title":"ERPNext: Server-Side Template Injection leading to Remote Code Execution","description":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01029,"percentile":0.6396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1336"],"published":"2026-08-17T20:44:20Z","modified":"2026-10-28T02:30:35Z","products":[{"vendor":"frappe","product":"erpnext"}],"references":[{"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-w996-r7v3-87wr","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/frappe/frappe/commit/529d190a252863672164d10bfcd91d1de0ac1c7c","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/frappe/erpnext/releases/tag/v15.111.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/frappe/erpnext/releases/tag/v16.22.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65974.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65974","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-65974","title":"ERPNext: Server-Side Template Injection leading to Remote Code Execution","description":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.","status":"published","published":"2026-08-17T20:44:20.818Z","modified":"2026-08-18T14:17:47.852Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-60451","description":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.","status":"published","published":"2026-08-17T20:44:20Z","modified":"2026-08-18T14:17:47Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:46.762528Z"}],"nvd":[{"id":"CVE-2026-65974","description":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.","status":"published","published":"2026-08-17T21:16:46.887Z","modified":"2026-10-23T16:10:00.313Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-65974","title":"ERPNext: Server-Side Template Injection leading to Remote Code Execution","description":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.","status":"published","published":"2026-08-17T20:44:20.818Z","modified":"2026-10-28T02:30:35.084849393Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:45:14.46177Z"}]}}