CVE-2026-65974

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.111.0 ERPNext versions prior to 16.22.0

Description Authenticated users with limited permissions can bypass security boundaries within the Frappe safe execution environment. This occurs because the frappe.render template() function is exposed without the restrict globals parameter being enforced, leading to server-side template injection (SSTI), where an attacker injects malicious code into a template that is then executed on the server, potentially resulting in remote code execution.

Recommendations Update to version 15.111.0. Update to version 16.22.0.