CVE-2026-119144: Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe Frameworkto a version that resolves this vulnerability.Fixed in 15.111.0 - Upgrade
Upgrade
Frappe Frameworkto a version that resolves this vulnerability.Fixed in 16.21.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated and hold a common operational role. No user interaction is required once the attacker can submit a controllable message field.
What is the impact of successful exploitation?
Injected template expressions are evaluated by the server in an unrestricted context. This can result in high-impact compromise of confidentiality, integrity, and availability.
Which deployments are affected?
Frappe Framework versions before 15.111.0 are affected, as are 16.x versions before 16.21.0. The issue occurs where user-controlled message fields are rendered as templates without neutralization.
How can teams determine whether they are exposed?
Verify the deployed Frappe Framework version and identify whether authenticated operational-role users can supply message-field content that is rendered server-side. Versions earlier than the stated fixed releases should be treated as affected.