CVE Feed

    Dashboard / CVE / CVE-2023-54345

    CVE-2023-54345

    Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.

    Published:May 5, 2026
    Last Modified:May 5, 2026
    EPS:May 5, 2026
    EPSS Score:0.00096
    CVSS Score:8.8

    Affected Products

    Vendor
    Erpnext
    Product
    Erpnext
    Vendor
    Frappe
    Product
    Erpnext

    Exploits

    https://gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6https://www.exploit-db.com/exploits/51580

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High