Server-Side Template Injection in Frappe Framework by Frappe Technologies

CVE-2026-119144

What is CVE-2026-119144?

The Frappe Framework, in versions prior to 15.111.0 and 16.x before 16.21.0, is susceptible to a server-side template injection attack. This vulnerability arises from the rendering of user-controlled message fields as templates without appropriate neutralization. An authenticated attacker with a standard operational role can leverage this flaw to inject template expressions, which the server will process in an unrestricted environment, potentially leading to unauthorized access or system compromise.

References