Frappe Framework server-side template injection through message fields enables server compromise (CVE-2026-119144)

What happened

Frappe Framework renders user-controlled message fields as templates without neutralising the template syntax. An attacker who already holds an ordinary operational role can insert template expressions into a message field, and the server evaluates those expressions in an unrestricted context. This is CWE-1336, server-side template injection.

The CVSS 4.0 vector is 8.7 high: network reachable, low attack complexity, low privileges, no user interaction, high impact on confidentiality, integrity and availability of the Frappe host, with no scope change. No active exploitation or public disclosure is recorded in the available advisory sources.

Who is affected

Frappe Framework 15.x before 15.111.0 and 16.0.0 to before 16.21.0. If you run Frappe or ERPNext, check the underlying Frappe version, not only the product version you see in your deployment. These systems typically hold finance, HR, customer or supplier data and are accessible to many authenticated operational users, making the low-privilege requirement significant.

What to do now

1. Identify every Frappe-based system in your estate and confirm its version against the affected ranges above.
2. Upgrade to the fixed releases: frappe 15.111.0 for the 15.x line, or frappe 16.21.0 for the 16.x line.
3. If patching must wait, restrict network access to the application to trusted networks and users, and review which operational roles can create or edit message fields. The available references do not describe a workaround.
4. After the update, verify the installed version and check for any remaining exposure.

Beyond the patch

Beyond this patch, the lesson is that a low-privilege operational account became a route to controlling the Frappe host through a normal application feature. An Implementation & Assessment Services engagement can test how your Frappe/ERPNext deployment is hardened and whether features such as message fields are safely isolated. Supply Chain Defense & Third-Party Risk helps track the Frappe versions and patch cadence across your suppliers and internal teams, so fixed releases like 15.111.0 and 16.21.0 reach production quickly.