Server-Side Template Injection in Frappe ERPNext Product

CVE-2025-66438

What is CVE-2025-66438?

A vulnerability exists in Frappe ERPNext's Print Format rendering process, which allows authenticated users with permission to create or modify Print Formats to inject arbitrary Jinja expressions. This occurs through the API functionality that invokes the rendering mechanism. Although the environment is sandboxed, it still exposes critical database access functions. If an attacker crafts a malicious Print Format and saves it, they can execute a privileged render process that discloses sensitive database information, such as schema details and versioning, through crafted payloads.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References