VulnSocial

CVE-2026-119144

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1336

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-30: 110-30
Referenced assets1 URL
Full discourse1 post
  • ThreatAft@ThreatAft

    🔐 CVE-2026-119144 — Frappe SSTI, CVSS 8.8 Research chained it to RCE: write a file, register it as an installed app, call it. Shell as the frappe user. No workaround. Patch: 15.111.0 / 16.21.0 https://threataft.com/articles/frappe-framework-cve-2026-119144-ssti-unrestricted-template #Frappe #ERPNext #SSTI #CVE

    0001037
    52 followersView on X

Explore more

Back to dashboard