Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.7 · frappeNVD modified 2026-10-28 19:10
Affected (CPE criteria) 1
cpe:2.3:a:frappe:erpnext:13.4.0:*:*:*:*:*:*:*
References 8
- http://erpnext.org Product
- https://frappeframework.com/docs/v13/user/en/desk/scripting/server-script Product
- https://gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6 Exploit
- https://github.com/frappe/frappe/ Product
- https://github.com/frappe/frappe/blob/v13.4.0/frappe/utils/safe_exec.py#L42 Product
- https://ur4ndom.dev/posts/2023-07-02-uiuctf-rattler-read/ Not Applicable
- https://www.exploit-db.com/exploits/51580 Exploit, VDB Entry
- https://www.vulncheck.com/advisories/frappe-framework-erpnext-remote-code-execution Third Party Advisory