High severity8.8NVD Advisory· Published May 5, 2026· Updated May 5, 2026
CVE-2023-54345
CVE-2023-54345
Description
Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6nvdExploit
- www.exploit-db.com/exploits/51580nvdExploitVDB Entry
- www.vulncheck.com/advisories/frappe-framework-erpnext-remote-code-executionnvdThird Party Advisory
- erpnext.orgnvdProduct
- frappeframework.com/docs/v13/user/en/desk/scripting/server-scriptnvdProduct
- github.com/frappe/frappe/blob/v13.4.0/frappe/utils/safe_exec.pynvdProduct
- ur4ndom.dev/posts/2023-07-02-uiuctf-rattler-read/nvdNot Applicable
News mentions
0No linked articles in our index yet.