CVE Feed

    Dashboard / CVE / CVE-2023-54406

    CVE-2023-54406

    Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.

    Published:Oct 12, 2026
    Last Modified:Oct 15, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00315
    CVSS Score:4.9

    Affected Products

    Vendor
    Frappe
    Product
    Frappe

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-140 Bypassing of Intermediate Forms in Multiple-Form Sets
    CAPEC-74 Manipulating State

    Related CVEs

    CVE-2026-119145 (CVSS 9.4) — Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-up…
    CVE-2026-119144 (CVSS 8.7) — Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerabili…
    CVE-2026-114664 (CVSS 7.1) — Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.…
    CVE-2026-111388 (CVSS 5.3) — Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist f…
    CVE-2026-55823 (CVSS 8.7) — Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview compo…
    CVE-2026-66057 (CVSS 5.1) — Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an …
    CVE-2026-109603 (CVSS 4.8) — Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-…
    CVE-2026-109602 (CVSS 5.1) — Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboa…
    CVE-2026-109601 (CVSS 7.1) — Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the …
    CVE-2026-109600 (CVSS 6.9) — Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled bef…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High