CVE-2025-66434: frappe erpnext Code Injection

Vulnerability summary

CVE-2025-66434 is a high (CVSS 8.8) Code Injection vulnerability in frappe erpnext. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.4% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 15-12-2025
   PublishedVulnerability first disclosed.
2. 17-12-2025
   Last modifiedVulnerability information updated.

Description

An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to configure Dunning Type and its child table Dunning Letter Text can inject arbitrary Jinja expressions, resulting in server-side code execution within a restricted but still unsafe context. This can leak database information.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-1336Improper Neutralization of Special Elements Used in a Template EngineThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.