An authenticated remote code execution vulnerability in ERPNext allows users to bypass permission boundaries and execute arbitrary code on the server.

The vulnerability arises because the frappe.render_template function is exposed without adequate global restriction checks. Authenticated users with limited privileges can leverage this to perform server-side template injection, resulting in remote code execution.

A successful exploit allows an authenticated user to achieve remote code execution, effectively granting them control over the ERP system. This compromises the confidentiality, integrity, and availability of sensitive business data, including financial records and operational intelligence. With a CVSS score of 9.9, this vulnerability represents an extreme risk to enterprise environments.

Immediate Action: Update frappe erpnext to version 15.111.0 or 16.22.0 immediately.

Proactive Monitoring: Audit audit logs for unusual template rendering activity or attempts to access restricted system functions by standard user accounts.

Compensating Controls: Restrict access to the application to trusted users only and employ Web Application Firewalls to filter for suspicious template injection patterns.

Public Exploit Available: No confirmed public weaponized exploit is available at this time.

Organizations running ERPNext must apply the provided security updates immediately. Given the high severity and the potential for full system compromise, administrators should treat this as a high-priority maintenance task to ensure the security of their enterprise data.