Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119144— Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields

Quick assessment

Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frappe Framework 15.111.0 之前版本以及 16.x 系列中 16.21.0 之前的版本存在服务端模板注入漏洞。该漏洞的成因是：用户可控的消息字段在未经过中和处理的情况下被直接作为模板进行渲染。持有普通操作角色的认证攻击者可以注入模板表达式，而这些表达式将在无限制的环境中由服务器执行。

CVSS 8.8 · High

Affected Version Matrix 4

VendorProduct Version RangeStatus
frappe frappe 16.0.0< 16.21.0 affected
16.21.0 unaffected
< 15.111.0 affected
15.111.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119144

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
frappe frappe 16.0.0 ~ 16.21.0 -
frappe frappe 0 ~ 15.111.0 -

II. Public POCs for CVE-2026-119144

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119144

请登录查看更多情报信息。

Other References for CVE-2026-119144 (2)

IV. Related Vulnerabilities

Same product: frappe
Same vendor: frappe
Same weakness: CWE-1336