ERPNext versions prior to 15.118.0 and 16.29.0 contain an improper neutralization of special elements used in a template engine (CWE-1336). The validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals, including frappe.utils. This allows an authenticated user with a common operational role to inject template expressions, leading to arbitrary server-side code execution and data disclosure across the application. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical severity. It is fixed in versions 15.118.0 and 16.29.0.

An authenticated user with a common operational role can exploit this vulnerability to execute arbitrary code on the server and read sensitive data across the ERPNext application. This compromises confidentiality, integrity, and availability of the system, potentially leading to full system compromise.

Upgrade ERPNext to version 15.118.0 or later, or 16.29.0 or later, where this vulnerability is fixed. No other mitigation or temporary fix is indicated. Patch status is not explicitly stated but the fix versions are known; therefore, applying these updates is the recommended remediation.