CVE-2023-54345

HighCVSS 8.8/10Last modified Oct 28, 2026

Description

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Frappe Technologies	Frappe Framework (ERPNext)	13.4.0

References

http://erpnext.orgProduct
https://frappeframework.com/docs/v13/user/en/desk/scripting/server-scriptProduct
https://gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6Exploit
https://github.com/frappe/frappe/Product
https://github.com/frappe/frappe/blob/v13.4.0/frappe/utils/safe_exec.py#L42Product
https://ur4ndom.dev/posts/2023-07-02-uiuctf-rattler-read/Not Applicable
https://www.exploit-db.com/exploits/51580Exploit, VDB Entry
https://www.vulncheck.com/advisories/frappe-framework-erpnext-remote-code-executionThird Party Advisory

Timeline

Published: May 5, 2026
Last modified: Oct 28, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-543467.5WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download c CVE-2023-543477.5OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repe CVE-2023-543488.8ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fi CVE-2023-543496.1AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts b CVE-2023-54356.5The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and in CVE-2023-543507.5WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated atta CVE-2023-543517.2WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malic CVE-2023-543529.8WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by upl CVE-2023-543537.8Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbit CVE-2023-543557.5PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 ellipt CVE-2023-543563.7Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SH CVE-2023-543577.5Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user