Description
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
Published: 2026-05-05
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a sandbox escape in the RestrictedPython engine of Frappe Framework (ERPNext) 13.4.0. It enables an authenticated user with the System Manager role to execute arbitrary code. The flaw is classified as CWE‑94, arising from unsafe evaluation of user‑supplied script code that can be leveraged to circumvent the provided execution sandbox.

Affected Systems

Affected products are ERPNext (Frappe Framework) version 13.4.0. Only this specific release is listed as vulnerable; no other product variants or versions are explicitly mentioned.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. Exploitation requires authenticated access and the ability to create a server script via the /app/server-script endpoint. Attackers can use the gi_frame attribute to traverse the call stack and invoke os.popen, thereby executing arbitrary system commands. The EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, but the impact is clear and the exploit path remains viable for any system exposed to System Manager traffic.

Generated by OpenCVE AI on May 5, 2026 at 12:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ERPNext to a version that includes the RestrictedPython sandbox fix, or apply the vendor’s patch that disables unsafe eval.
  • If an upgrade is not possible, immediately remove or lock down the /app/server-script endpoint and restrict System Manager privileges to trusted accounts only.
  • As a temporary workaround, disable or patch the safe_exec.py module so that it rejects code containing os.popen or similar system‑call patterns, ensuring the script engine does not allow arbitrary command execution.

Generated by OpenCVE AI on May 5, 2026 at 12:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 05 May 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 05 May 2026 11:45:00 +0000

Type Values Removed Values Added
Description Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
Title Frappe Framework ERPNext 13.4.0 Remote Code Execution
First Time appeared Erpnext
Erpnext erpnext
Weaknesses CWE-94
CPEs cpe:2.3:a:erpnext:erpnext:13.4.0:*:*:*:*:*:*:*
Vendors & Products Erpnext
Erpnext erpnext
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erpnext Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-05T12:25:34.862Z

Reserved: 2026-01-10T01:51:52.984Z

Link: CVE-2023-54345

cve-icon Vulnrichment

Updated: 2026-05-05T12:25:29.288Z

cve-icon NVD

Status : Received

Published: 2026-05-05T12:16:16.850

Modified: 2026-05-05T12:16:16.850

Link: CVE-2023-54345

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-05T13:00:07Z

Weaknesses