Threats tagged 'ghsa-38wh-wgq2-g439'

Frappe Framework versions prior to 15.111.0 and 16.x versions before 16.21.0 contain a server-side template injection vulnerability. This flaw allows an authenticated attacker with common operational privileges to inject and execute arbitrary template expressions on the server. The vulnerability arises because user-controlled message fields are rendered as templates without proper neutralization, enabling unrestricted server-side code execution.