Frappe ERPNext CVE-2025-66434

Exploitation requires an authenticated Frappe/ERPNext user with permission to configure the Dunning Type doctype and edit its Dunning Letter Text child table (the body_text field). The injected Jinja2 is only reachable through the get_dunning_letter_text code path that renders body_text via frappe.render_template() with the doc context. Impact is bounded by Frappe's custom SandboxedEnvironment - full RCE is limited, but dangerous globals exposed through get_safe_globals(), notably frappe.db.sql, permit database access and information disclosure. Key limiting factors: valid authenticated session, the specific Dunning configuration privilege (not a default low-privilege/anonymous role), and affected versions up to and including 15.89.0.

This is a genuine priority for organizations running Frappe/ERPNext, though several signals temper the raw CVSS 8.8. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation with no user interaction, and public exploit code exists (two write-ups referenced via NVD), which raises practical exploitability. However, PR:L confirms authentication is required - specifically an account privileged enough to configure Dunning Type and its Dunning Letter Text child table - so this is not an unauthenticated internet-wide mass-exploitation candidate. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of confirmed active exploitation; the risk signal rests on POC availability plus low attack complexity. The vendor-assigned C:H/I:H/A:H is arguably optimistic: the description itself states execution occurs 'within a restricted but still unsafe context' inside Frappe's custom SandboxedEnvironment, with the concrete demonstrated impact being database information leakage via the exposed frappe.db.sql global - i.e. the sandbox meaningfully constrains full OS-level RCE despite the RCE/Code Injection tags. Net: a real, patch-worthy authenticated SSTI/data-exposure issue, not a drop-everything unauthenticated RCE.

An attacker who already holds (or phishes/compromises) a Frappe account with permission to edit Dunning Type configuration injects a malicious Jinja2 expression - e.g. one invoking frappe.db.sql - into the Dunning Letter Text body_text field. When get_dunning_letter_text renders the template via frappe.render_template() with the document context, the payload executes server-side inside the sandbox and returns sensitive database contents. Public proof-of-concept write-ups demonstrating this SSTI are already available, lowering the bar to reproduce.