Skip to content

frappe.flags.in_safe_exec can become False while executing a Server Script

Moderate
ankush published GHSA-v3vh-7qx4-f582 Dec 18, 2023

Package

frappe (Frappe)

Affected versions

<=14.58.0
<=15.4.1

Patched versions

14.59.0
15.5.0

Description

Summary

Because a server script can trigger other server scripts (when saving a document for example), the value of the frappe.flags.in_safe_exec global flag is not always True while executing a server script.

Severity

Moderate
4.9
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CVE ID

No known CVE

Weaknesses

No CWEs

Credits