Advisory · CVE-2026-119144
Server-side template injection in Frappe Framework message fields
Frappe Framework before 15.111.0 and 16.x before 16.21.0 lets an authenticated attacker holding a common operational role inject template expressions that the server evaluates in an unrestricted context. It is rated high at CVSS 8.8.
- Vendor
- Frappe
- Product
- Frappe Framework
- Identifier / CWE
- CVE-2026-119144
CWE-1336 - Action timing
- Immediate
Explain it like I’m five
Frappe lets users write messages, but it treats some message text as a template to run rather than plain words. An authenticated user with an ordinary job role slips template commands into a message and the server runs them.
- 01Operational role
An authenticated attacker holds a common operational role in Frappe.
- 02Template injected
User-controlled message fields are rendered as templates without neutralization.
- 03Unrestricted evaluation
The injected template expressions run in an unrestricted server context.
What happened
Frappe disclosed CVE-2026-119144 in Frappe Framework before 15.111.0 and 16.x before 16.21.0: user-controlled message fields are rendered as templates without neutralization, so an authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context. It is rated high at CVSS 3.1 8.8, with low privileges required and no user interaction.
Frappe powers ERPNext and a large ecosystem of business applications, so template execution on the server can reach business data and, depending on deployment, the host itself. The vendor advisory states there are no workarounds and that updating resolves it.
What to do
- Inventory Frappe and ERPNext deployments and identify their framework branch.
- Upgrade to Frappe Framework 15.111.0 or later on the 15.x line, or 16.21.0 or later on the 16.x line.
- Review which roles can create or edit message content, and restrict that access while patching.
- Review application logs for unusual template content in message fields.
- Investigate any unexpected server-side activity on instances where suspicious messages appear.
Management note
No workaround exists for this one, so the upgrade is the fix. Business systems running Frappe should be patched promptly given the low-privilege precondition.