CVE-2026-38431: ERPNext SSTI RCE Vulnerability

CVE-2026-38431 Overview

CVE-2026-38431 is a Server-Side Template Injection (SSTI) vulnerability affecting ERPNext v15.103.1 and earlier versions. The flaw resides in the Frappe email template engine. An attacker with permission to create or edit email templates can inject template expressions that execute on the server when the template is rendered. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code) and can lead to remote code execution on the underlying ERPNext host.

Critical Impact
Authenticated users with email template privileges can achieve server-side code execution, leading to full compromise of confidentiality, integrity, and availability of the ERPNext instance.

Affected Products

ERPNext v15.103.1
ERPNext versions prior to v15.103.1
Frappe email template engine component within affected ERPNext releases

Discovery Timeline

2026-05-05 - CVE-2026-38431 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-38431

Vulnerability Analysis

ERPNext uses the Frappe framework's Jinja-based template engine to render email templates. The engine evaluates template expressions server-side at render time. The application allows users with email template management permissions to supply template content without sufficiently restricting the expressions that the engine will evaluate.

When a crafted template is rendered, the engine executes attacker-controlled expressions inside the application's Python context. This grants the attacker the same execution privileges as the ERPNext worker process. SSTI in Jinja-based engines typically allows attackers to traverse Python object hierarchies and reach modules that perform file, network, or process operations.

The network attack vector and lack of user interaction make exploitation straightforward once an account with template privileges is obtained. Public technical analysis of the issue is available in the Hashnode blog post on SSTI in the ERPNext Frappe email template engine.

Root Cause

The root cause is the absence of a sandboxed or restricted rendering environment for user-supplied email template content. The Frappe email template engine evaluates template expressions without filtering dangerous attribute access, builtins, or module references. Any user with create or edit rights on email templates can therefore inject Jinja expressions that escape the intended templating context and reach Python's runtime objects.

Attack Vector

An attacker authenticates to ERPNext with an account that has email template management permissions. The attacker creates or edits an email template and embeds malicious Jinja expressions in the subject or body. When the application renders the template — for example, when sending an automated email — the server evaluates the expressions. The attacker leverages object traversal techniques common to Jinja SSTI to reach os or subprocess equivalents and execute arbitrary commands as the ERPNext service account.

No verified exploit code is published in the enriched data. Refer to the linked technical reference for proof-of-concept details.

Detection Methods for CVE-2026-38431

Indicators of Compromise

Email template records containing Jinja syntax referencing Python internals such as __class__, __mro__, __subclasses__, __globals__, __import__, os.popen, or subprocess.
Unexpected child processes spawned by the ERPNext or Frappe worker user, particularly shells, network utilities, or Python interpreters.
Outbound connections from ERPNext application servers to unfamiliar external hosts shortly after email send events.

Detection Strategies

Audit the Email Template doctype in the ERPNext database for template expressions outside the expected variable set used by your business workflows.
Enable and review Frappe application logs for template rendering errors that reference unexpected attributes or modules, which often accompany SSTI probing.
Correlate email send events with process creation telemetry on application servers to identify rendering-triggered command execution.

Monitoring Recommendations

Monitor ERPNext role assignments and alert when accounts gain Email Template Manager or equivalent permissions outside change windows.
Track file integrity on Frappe and ERPNext installation directories to detect post-exploitation persistence.
Forward web server, application, and host process logs to a centralized analytics platform to support cross-source correlation of template edits, send events, and child process activity.

How to Mitigate CVE-2026-38431

Immediate Actions Required

Upgrade ERPNext to a release later than v15.103.1 that contains the SSTI fix as soon as it is available from the vendor.
Restrict the email template create and edit permissions to a minimal set of trusted administrators.
Review existing email templates for malicious or unexpected Jinja expressions and remove any unauthorized content.
Rotate credentials, API keys, and secrets accessible from the ERPNext host if exploitation is suspected.

Patch Information

No specific patched version or vendor advisory URL is included in the enriched CVE data. Administrators should consult the official ERPNext and Frappe project release notes for the fix corresponding to CVE-2026-38431 and apply the latest stable release that addresses the SSTI in the email template engine. Technical context is documented in the Hashnode blog post on SSTI in ERPNext.

Workarounds

Remove the email template management permission from non-administrative roles until the patched version is deployed.
Implement input review workflows that require a second administrator to approve email template changes before they take effect.
Place the ERPNext application behind a web application firewall and inspect template-related requests for Jinja payload patterns such as {{ followed by __ sequences.
Run the ERPNext worker process under a least-privilege service account with restricted filesystem and network access to limit the impact of successful SSTI exploitation.