{"id":"CVE-2026-119144","aliases":[],"cve":{"records":[{"id":"CVE-2026-119144","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T14:28:41.595Z","published":"2026-10-29T15:58:22.718Z","modified":"2026-10-29T15:58:22.718Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-29T15:58:22.718Z"}],"references":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-6pmg-vc6m-6wrr","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/frappe-framework-before-15.111.0-and-16-x-before-16.21.0-server-side-template-injection-via-message-fields","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-1336","description":"Improper Neutralization of Special Elements Used in a Template Engine","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*","versionEndExcluding":"16.21.0","versionStartIncluding":"16.0.0"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*","versionEndExcluding":"15.111.0"}]}]}]}],"prioritization":[]},"title":"Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.","score":8.8,"severity":"high","published":"2026-10-29T15:58:22.718Z","modified":"2026-10-29T15:58:22.718Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"frappe","name":"frappe","platforms":[],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.21.0","versionType":"semver"},{"version":"16.21.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/frappe","packageIdentity":{"ecosystem":"PyPI","name":"frappe"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119144"},{"vendor":"frappe","name":"frappe","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"15.111.0","versionType":"semver"},{"version":"15.111.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:pypi/frappe","packageIdentity":{"ecosystem":"PyPI","name":"frappe"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119144"}],"remediation":[],"references":["https://github.com/frappe/frappe/security/advisories/GHSA-6pmg-vc6m-6wrr","https://www.vulncheck.com/advisories/frappe-framework-before-15.111.0-and-16-x-before-16.21.0-server-side-template-injection-via-message-fields"],"sources":[{"name":"CVE","id":"CVE-2026-119144","modified":"2026-10-29T15:58:22.718Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119144"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-10-29T17:06:18.424Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T12:15:32.680Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Frappe Framework versions before 15.111.0 and 16.x before 16.21.0 have a server-side template injection vulnerability. An authenticated attacker can inject template expressions via user-controlled message fields. This allows evaluation in an unrestricted context.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:02:29.022Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119144"}]}}