Beveiligingsadvies

CVE-2023-54345

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-05 11:24:49

Laatst bijgewerkt 2026-05-25 23:41:22

Toegewezen door VulnCheck

CVSS-score 8.8

Status PUBLISHED

Beschrijving

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.

← Alle CVE's bekijken Bekijk op cve.org ↗