CVE-2023-54406: Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts

Q: Which deployments are exposed?

Deployments running Frappe versions before 14.59.0, or 15.x versions before 15.5.0, are affected if high-privileged authenticated users can create or modify Server Scripts.

Q: What does an attacker need to exploit this issue?

An attacker needs authenticated high-privileged access and the ability to craft a Server Script. The script must trigger another Server Script, for example by saving a document, causing subsequent code to execute after the safe-execution flag becomes False.

Q: Is this exploitable by an unauthenticated remote attacker?

No. The provided vector requires high privileges and authenticated access; no user interaction is required.

Q: What version should be used to remediate the issue?

Upgrade Frappe to 14.59.0 or later on the 14.x branch, or to 15.5.0 or later on the 15.x branch.

Published Oct 12, 2026

Updated

Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.insafeexec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.

Affected Software

1 affected component

Frappe frappe<14.59.0, <15.5.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments running Frappe versions before 14.59.0, or 15.x versions before 15.5.0, are affected if high-privileged authenticated users can create or modify Server Scripts.

What does an attacker need to exploit this issue?

An attacker needs authenticated high-privileged access and the ability to craft a Server Script. The script must trigger another Server Script, for example by saving a document, causing subsequent code to execute after the safe-execution flag becomes False.

Is this exploitable by an unauthenticated remote attacker?

No. The provided vector requires high privileges and authenticated access; no user interaction is required.

What version should be used to remediate the issue?

Upgrade Frappe to 14.59.0 or later on the 14.x branch, or to 15.5.0 or later on the 15.x branch.

CVE-2023-54406: Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Is this exploitable by an unauthenticated remote attacker?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Is this exploitable by an unauthenticated remote attacker?

What version should be used to remediate the issue?