Frappe ERPNext CVE-2025-66435

Requires an authenticated ERPNext account (through 15.89.0) that holds create/modify permission on the Contract Template doctype; the attacker places a Jinja2 expression into the contract_terms field, which get_contract_template later passes to frappe.render_template() with the doc context. Exploitation is limited by that privilege requirement (not available to anonymous or minimally-privileged users) and by Frappe's custom SandboxedEnvironment, which restricts available operations - though get_safe_globals() still exposes frappe.db.sql, enabling database reads. No special non-default configuration is needed beyond having Contract Template functionality in use and a user role permitted to edit templates.

This is a medium-severity, authenticated information-disclosure issue rather than a top-priority emergency. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) shows network-reachable, low-complexity exploitation but requires an authenticated account (PR:L) and yields only limited confidentiality impact with no integrity or availability effect. A public PoC exists (two NVD-referenced exploit writeups), which raises practical exploitability, but KEV status is NO and no EPSS score was provided, so there is no evidence of active or widespread exploitation - exploitation is therefore proof-of-concept only, not confirmed in-the-wild. The input Tags ('RCE', 'Code Injection') overstate the practical outcome relative to the CVSS vector: the description itself scopes impact to code execution 'within a restricted but still unsafe context' used 'to leak database information', consistent with C:L/I:N/A:N rather than full remote code execution. One signal worth noting as potentially understated: because the sandbox still exposes frappe.db.sql, an attacker can read arbitrary database rows, which is arguably higher than C:L - verify the real blast radius against your data sensitivity. Net: a real but gated issue (privileged insider or compromised low-trust account needed), not an unauthenticated internet-facing RCE.

An attacker who holds an ERPNext account with permission to create or edit a Contract Template logs in and inserts a malicious Jinja2 expression (e.g., one calling frappe.db.sql) into the contract_terms field. When get_contract_template renders the template via frappe.render_template() with the doc context, the expression executes server-side inside the sandbox and returns database contents to the attacker. Public PoC/writeups demonstrating this technique are referenced by NVD, lowering the bar to reproduce it.