{"id":"CVE-2026-119144","published":"2026-10-29T16:18:08.117","lastModified":"2026-10-29T16:18:08.230","description":"Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1336"],"vendors":[],"products":[],"references":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-6pmg-vc6m-6wrr","tags":[]},{"url":"https://www.vulncheck.com/advisories/frappe-framework-before-15.111.0-and-16-x-before-16.21.0-server-side-template-injection-via-message-fields","tags":[]}],"exploitRefs":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-6pmg-vc6m-6wrr","tags":[]}],"hasPoc":true,"ai":null}