CVE-2023-54406

Deferred Deferred - Pending Action

Frappe Server Script Sandbox Bypass Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2023-54406

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	15.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-372	The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

Attack-Flow Graph

Executive Summary

Frappe versions before 14.59.0 and 15.x before 15.5.0 have a sandbox flaw where the frappe.flags.in_safe_exec flag can be set to False during Server Script execution. This happens when one server script triggers another, allowing authenticated high-privileged users to bypass safe execution protections by crafting a script that triggers others, such as through document saves.

Impact Analysis

Authenticated high-privileged users could exploit this flaw to execute malicious code without safe execution restrictions. This may lead to unauthorized data access, modification, or system compromise, depending on the privileges of the compromised account.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be impacted if sensitive data is exposed or altered due to the lack of safe execution protections.

Mitigation Strategies

Upgrade Frappe to version 14.59.0 or later if using version 14.x, or to version 15.5.0 or later if using version 15.x. This addresses the sandbox flaw by ensuring safe execution protections remain active.

Hi! I’m here to help you understand CVE-2023-54406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70