CVE-2025-66437: erpnext through 15.89.0 (inclusive); +1 more affected products

Affected technology

erpnext · through 15.89.0 (inclusive)
frappe

n/a · n/a
Vendor not specified by the source

Description’s affected range: through 15.89.0

Component: Not specified by the source
Function: renders

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker with permission to create or modify an Address Template can inject arbitrary Jinja expressions into the template field. NVD’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high. Source advisory’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.