GHSA-6pmg-vc6m-6wrr: Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
Published Oct 29, 2026
·Updated
Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe Frameworkto a version that resolves this vulnerability.Fixed in 15.111.0 - Upgrade
Upgrade
Frappe Frameworkto a version that resolves this vulnerability.Fixed in 16.21.0
Event History
Oct 29, 2026
CVE Published
via OSV·03:58 PM
Data Sourced
via OSV·03:58 PM
DescriptionSeverityWeakness