A remote code execution vulnerability in Frappe Technologies Frappe Framework ERPNext version 13.4.0 allows authenticated users to achieve full system compromise via frame introspection.

This is a code injection vulnerability classified under CWE-94, caused by improper control of generated code within RestrictedPython. An authenticated attacker with the System Manager role can exploit frame introspection through the server script endpoint to invoke system commands, with the attack vector requiring network access and low privileges.

A successful exploit grants the attacker the ability to execute arbitrary system commands with the privileges of the underlying application server, leading to total confidentiality, integrity, and availability loss. The CVSS score of 8.8 reflects the severity of this remote code execution risk, which could expose sensitive enterprise data, disrupt business operations, and compromise the entire hosting infrastructure.

Immediate Action: Restrict access to the server script creation functionality and apply vendor security updates as soon as they become available.

Proactive Monitoring: Monitor access logs and system scripts for unauthorized creation or modification of server scripts via the endpoint.

Compensating Controls: Implement strict role-based access control to ensure only highly trusted administrators hold the System Manager role.

Public Exploit Available: Yes, an ExploitDB entry exists (Exploit-DB ID 51580).

Organizations utilizing the affected version should treat this vulnerability with high priority due to the availability of a public exploit and the severity of potential remote code execution. Administrators must audit administrative accounts and apply patches or mitigations immediately to prevent unauthorized command execution.