PT-2026-132375

CVE-2026-119144

Published

2026-10-29

Updated

2026-10-30

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frappe Framework versions prior to 15.111.0 Frappe Framework versions 16.x prior to 16.21.0

Description An issue exists where user-controlled message fields are rendered as templates without proper neutralization, leading to server-side template injection. An authenticated attacker with a common operational role can inject template expressions that the server evaluates in an unrestricted context.

Recommendations Update to version 15.111.0 or later. Update to version 16.21.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers