Security Advisory

CVE-2023-54345

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-05 11:24:49

Last updated 2026-05-25 23:41:22

Assigner VulnCheck

CVSS score 8.7

State PUBLISHED

Description

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.

← Browse all CVEs View on cve.org ↗