CVE-2023-54406
4.9MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-372
Impact
High-privileged authenticated users can escape the Python sandbox and execute unsafe code on the server. They need an account with permissions to create or edit Server Scripts.
Root cause
The global frappe.flags.in_safe_exec sandbox flag resets to False when one Server Script triggers another, executing subsequent code without sandbox restrictions.
Affected systems
Frappe versions before 14.59.0 and 15.x before 15.5.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Upgrade Frappe to version 14.59.0, 15.5.0, or later. If updating immediately is not possible, disable the Server Script feature in site_config.json by setting server_script_enabled to false.
$ bench update --patchAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.