High · published December 15, 2025
⚡ An authenticated user can unleash a server-side template injection in ERPNext with just the right address! 💥 Think of it like a restaurant accepting orders without checking what’s written on the receipt — they might just serve whatever the sneaky chef scribbled down. This vulnerability allows attackers to manipulate the address templates and potentially dish out dangerous commands directly to the server. If exploited, an attacker could execute arbitrary code on the server or leak sensitive database information, which is absolutely terrifying for any business relying on ERPNext for their operations. This can lead to complete compromise of the system, allowing attackers to alter data or steal confidential information, turning your trusted ERP system into a playground for malicious activities.
Think of it like a restaurant accepting orders without checking what’s written on the receipt — they might just serve whatever the sneaky chef scribbled down. This vulnerability allows attackers to manipulate the address templates and potentially dish out dangerous commands directly to the server. The vulnerability in the get_address_display method allows an authenticated user to inject Jinja expressions through the address_dict parameter. Since the function uses a custom Jinja2 SandboxedEnvironment but still exposes dangerous functions via get_safe_globals(), it opens the door for remote code execution or data leaks.
If exploited, an attacker could execute arbitrary code on the server or leak sensitive database information, which is absolutely terrifying for any business relying on ERPNext for their operations. This can lead to complete compromise of the system, allowing attackers to alter data or steal confidential information, turning your trusted ERP system into a playground for malicious activities. To secure your system, apply the latest patch to the affected version (15.89.1 or later), and review your user permissions to ensure that only trusted users can create or modify Address Templates. Additionally, consider implementing stricter input validation for any template fields to avoid injection risks. You've got this! By taking these steps, you’ll be protecting your system like a pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| frappe/erpnext | ≤ 15.89.0 | — |