ERPNext CVE-2026-65974

Requires an authenticated ERPNext account (PR:L) with the ability to supply or trigger rendering of Jinja template content through a Frappe feature that routes into safe_exec's render_safe_globals - for example custom print formats, email/notification templates, web templates/pages, or server scripts that call render_template. The limiting factor is that a fully anonymous, unauthenticated outsider cannot exploit this directly: an attacker must first hold at least a low-privilege ('limited') user role and reach a template-authoring or template-execution surface. No special non-default configuration is needed beyond having such users, and no victim interaction is required; any ERPNext instance before 15.111.0 / 16.22.0 that grants semi-trusted users template-editing capability is exposed.

The signals are largely aligned toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) describes a network-reachable, low-complexity attack needing only limited privileges and no user interaction, with a scope change reflecting sandbox escape to full host compromise. SSTI leading to RCE is a well-understood, reliable exploitation class, so the modest PR:L barrier (any authenticated ERPNext user who can reach a template-rendering feature) is the main gating factor rather than a strong mitigant. No EPSS score is provided and the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation yet - but the patch commit is public, which materially lowers the effort to reconstruct a working exploit. Because ERPNext instances are frequently multi-tenant or exposed to semi-trusted internal users, any operator running a version prior to 15.111.0 or 16.22.0 should treat this as urgent and patch promptly rather than waiting for in-the-wild reports.

A low-privileged ERPNext user with access to a feature that renders Jinja (such as a custom print format, notification template, or web template) injects a template payload like {{ ...os.popen('id')... }} that, once rendered by the unrestricted render_template inside safe_exec, executes attacker-controlled OS commands on the server. Because the vector is network-based with low complexity and no user interaction, the attacker only needs a valid limited account; no public POC is referenced, but the SSTI-to-RCE pattern is straightforward to weaponize from the public fix diff.