High · published December 15, 2025
⚡ A sneaky Server-Side Template Injection hides in Frappe ERPNext, ready to let attackers inject Jinja2 templates like a chef slipping ingredients into a recipe! 🍽️ Think of it like a restaurant where the chef trusts customers to write down their own order, but some customers are mischief-makers who might ask for something bizarre or harmful! Here, an authenticated attacker can inject harmful code instead of just plain text, leading to worrisome results. An attacker could execute arbitrary code on the server, potentially leaking sensitive database information. Imagine a scenario where they can access customer records or financial details, all thanks to a crafty template injection! This could be absolutely devastating for the trust and security of your business.
Think of it like a restaurant where the chef trusts customers to write down their own order, but some customers are mischief-makers who might ask for something bizarre or harmful! Here, an authenticated attacker can inject harmful code instead of just plain text, leading to worrisome results. The vulnerability arises in the get_dunning_letter_text method of Frappe ERPNext, where attacker-controlled Jinja2 templates are rendered using the frappe.render_template() function. Despite using a custom SandboxedEnvironment, dangerous globals remain accessible, allowing attackers to run harmful code.
An attacker could execute arbitrary code on the server, potentially leaking sensitive database information. Imagine a scenario where they can access customer records or financial details, all thanks to a crafty template injection! This could be absolutely devastating for the trust and security of your business. To mitigate this vulnerability, patch Frappe ERPNext to version 15.89.1 or later immediately. Additionally, review your implementations of the Dunning Type and Dunning Letter Text to limit user access and sanitize inputs effectively. 🛡️ This is fixable! Take action now, and you'll be on your way to leveling up your security game! 🚀
| Product | Versions | Fixed in |
|---|---|---|
| frappe/erpnext | ≤ 15.89.0 | — |