UpHeron
All vulnerabilities

Servers and applications

GHSA-qrxv-3vjh-gpx7

Sandbox bypass via imported functions leaking into Jinja globals through module-path hooks

Severity
High
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
15.121.2, 16.36.0
Sources
Project advisories (GitHub)

Description

A user who can author a rendered template (e.g. a Print Format) can call any function imported into a module-path-hooked module by name, and get server-side code execution that bypasses the Jinja sandbox.

From frappe/frappe's security advisory.

Workarounds

There are no workarounds. Updating to the latest versions of Frappe Framework should resolve this.

Workarounds as given by frappe/frappe's security advisory.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 16.36.0
  • Every version before 15.121.2

References