CVE-2023-54345

🗓️ 05 May 2026 11:24:49Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 5 Views🌐 WEB

Remote code execution in ERPNext 13.4.0 via sandbox escape in RestrictedPython for System Manager users.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2023-54345	5 May 202611:24	–	attackerkb
Circl	CVE-2023-54345	5 May 202614:33	–	circl
CNNVD	ERPNext 代码注入漏洞	5 May 202600:00	–	cnnvd
Cvelist	CVE-2023-54345 Frappe Framework ERPNext 13.4.0 Remote Code Execution	5 May 202611:24	–	cvelist
EUVD	EUVD-2023-60566	5 May 202612:31	–	euvd
NVD	CVE-2023-54345	5 May 202612:16	–	nvd
Positive Technologies	PT-2026-37000	5 May 202600:00	–	ptsecurity
Vulnrichment	CVE-2023-54345 Frappe Framework ERPNext 13.4.0 Remote Code Execution	5 May 202611:24	–	vulnrichment

NVD

Vulners

CNA

Node

frappe erpnextMatch13.4.0

[
  {
    "vendor": "Frappe Technologies",
    "product": "Frappe Framework (ERPNext)",
    "versions": [
      {
        "version": "13.4.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
frappeframework	www.frappeframework.com/docs/v13/user/en/desk/scripting/server-script
github	www.github.com/frappe/frappe/blob/v13.4.0/frappe/utils/safe_exec.py
ur4ndom	www.ur4ndom.dev/posts/2023-07-02-uiuctf-rattler-read/
exploit-db	www.exploit-db.com/exploits/51580
github	www.github.com/frappe/frappe/
vulncheck	www.vulncheck.com/advisories/frappe-framework-erpnext-remote-code-execution
gist	www.gist.github.com/lebr0nli/c2fc617390451f0e5a4c31c87d8720b6
erpnext	www.erpnext.org/

Parameter	Position	Path	Description	CWE
script	request body	/app/server-script	Sandbox escape via RestrictedPython allowing authenticated System Manager to execute arbitrary OS commands through /app/server-script.	CWE-94

25 May 2026 23:41Current

6.2Medium risk

Vulners AI Score6.2

CVSS 48.7

CVSS 3.18.8

EPSS0.0011

SSVC

CWE-94