Frappe Framework server-side template injection in message fields gives authenticated attackers high server impact (CVE-2026-119144)

What happened

CVE-2026-119144 is a server-side template injection vulnerability in Frappe Framework. Message fields that can be controlled by users are passed to the template renderer without neutralization. This means an authenticated attacker can submit template expressions in those fields, and the server then evaluates them in an unrestricted context. The CVSS 4.0 record describes the weakness as reachable over the network with low privileges and no user interaction after authentication.

The CVSS score is 8.7, rated high. Impact on the vulnerable component is high for confidentiality, integrity and availability, with no impact on subsequent systems. The CVE record does not list active exploitation or public disclosure, and CISA KEV does not carry an entry for this CVE.

Who is affected

Affected product: Frappe Framework. The affected release lines are 16.0.0 through versions before 16.21.0, and versions before 15.111.0. If you run a version before 15.111.0 or a 16.x version before 16.21.0, you are affected. Deployments where authenticated users with common operational roles can submit message fields should treat this as a patch priority.

What to do now

1. Upgrade to a fixed release. The fixed versions are frappe 15.111.0 and frappe 16.21.0. Use frappe 15.111.0 for installations on a release before 15.111.0, and frappe 16.21.0 for installations on the 16.x line.
2. Confirm your current Frappe Framework version and patch affected systems through your normal change-management process, prioritising network-reachable instances.
3. No workaround has been published in the references for this advisory. Treat patching as the primary control.

Beyond the patch

This is the kind of upstream framework fix that only helps once you know where the component is deployed and how quickly your team can move. For organisations running Frappe Framework, the work after a fix like this is knowing where each instance is and how quickly it can be patched. Spirity's Supply Chain Defense & Third-Party Risk tracks supplier and open-source patch cycles and exposure windows; Implementation & Assessment Services can test how a Frappe deployment handles user-controlled fields and review template-rendering paths.