CVE-2025-66436: frappe erpnext Code Injection

Vulnerability summary

CVE-2025-66436 is a medium (CVSS 4.3) Code Injection vulnerability in frappe erpnext. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.7% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 15-12-2025
   PublishedVulnerability first disclosed.
2. 17-12-2025
   Last modifiedVulnerability information updated.

Description

An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Terms and Conditions document can inject arbitrary Jinja expressions into the terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-1336Improper Neutralization of Special Elements Used in a Template EngineThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.