CVE-2026-119144

    Dashboard / Vulnerabilities / CVE-2026-119144

    CVE-2026-119144

    Published: 29 Oct 2026Last Modified: 5 Nov 2026

    Summary: Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields

    Details: Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119144.json, https://github.com/frappe/frappe/security/advisories/GHSA-6pmg-vc6m-6wrr, https://nvd.nist.gov/vuln/detail/CVE-2026-119144, https://www.vulncheck.com/advisories/frappe-framework-before-15.111.0-and-16-x-before-16.21.0-server-side-template-injection-via-message-fields

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fcbe4d62d66cb4a5d46ff9c5004af1a80a5f6976
    Fixed -b7594391f5f3456860708cfcfe006b6298ca9032

    Affected versions

    v16.20.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119144 | CVE-DB