Frappe ERPNext CVE-2025-66437

Exploitation requires an authenticated account holding the specific permission to create or modify an Address Template document in ERPNext, plus the ability to create an Address document with a country matching the malicious template and to call the get_address_display API with address_dict set to that Address document's name. The core technical prerequisite is that the custom Jinja2 SandboxedEnvironment still exposes dangerous callables such as frappe.db.sql via get_safe_globals(), which is the default framework behavior. Limiting factors that reduce real-world risk: the attacker must already be authenticated and must have Address Template write permission (an administrative-level capability typically not granted to ordinary users), so deployments that restrict Address Template editing to trusted administrators substantially narrow the exposed population; versions through 15.89.0 are affected.

This is a genuine high-priority issue, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with the CWE-94 code-injection/SSTI-to-RCE nature of the flaw. The strongest escalating signal is that public exploit code exists (POC=YES), with two referenced write-ups describing the technique, which lowers the barrier to opportunistic abuse. Tempering factors: this is NOT in CISA KEV (no confirmed active exploitation), and no EPSS probability was supplied in the input, so widespread automated exploitation cannot be asserted. One nuance to verify: although the vector encodes PR:L, the description specifies the attacker must hold permission to create or modify an Address Template - a relatively privileged administrative capability in ERPNext - so in hardened deployments the effective privilege bar may be closer to PR:H than PR:L; the 8.8 score may slightly overstate risk where Address Template editing is tightly restricted. No SSVC decision data was provided in the input. Net: treat as a priority patch for internet-exposed or multi-tenant ERPNext instances, but realistic exploitation depends on how loosely the Address Template permission is granted.

An authenticated ERPNext user who has been granted permission to edit Address Templates injects a malicious Jinja2 expression (e.g., leveraging frappe.db.sql exposed through get_safe_globals()) into a template's field, then creates an Address document whose country matches that template. When get_address_display is invoked via the API with address_dict set to the address name, frappe.render_template() evaluates the attacker's payload, resulting in server-side code execution or database information disclosure. Public proof-of-concept write-ups documenting this chain already exist, reducing the effort required to reproduce it.