The vulnerability, classified as CWE-372, is a sandbox flaw that triggers when a server script executes another server script, causing the global flag frappe.flags.in_safe_exec to be set to False and disabling safe execution protections. Authenticated users with high privileges can deliberately construct a server script that initiates another script, such as by saving a document, thereby executing subsequent code outside the intended sandbox. This bypass can lead to arbitrary code execution or other privileged operations that violate confidentiality, integrity, and availability, as the code runs with elevated privileges without the expected restrictions.

Affected are installations of the Frappe framework from any vendor identified as frappe, specifically versions prior to 14.59.0 and 15.x prior to 15.5.0. Users running these versions are exposed to the sandbox bypass flaw and must upgrade to a patched release.

The CVSS score of 6.9 indicates moderate severity. EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting a moderate likelihood of exploitation. The attack vector requires authenticated access with high privileges and depends on the ability to create or modify server scripts, which is typically restricted to administrators or power users. When these conditions are met, an attacker could chain script execution to remove safe execution constraints and run arbitrary code.