CVSS 9.83 sources verified·1 min read
By Lyrie Threat Intelligence·5/6/2026
CRITICAL: CVE-2026-38431 (CVSS 9.8) — multiple products
CVE: CVE-2026-38431
CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL
Status: Critical advisory
Affected
_See vendor advisory_
Summary
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.
Verified Sources
References
- https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine
- https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine
_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._
Lyrie Verdict
A vulnerability of this severity is exactly what Lyrie's anti-rogue-AI defense is built for: continuous, autonomous monitoring that doesn't wait for human reaction time.
Validated sources
- [1]NVD
- [2]GitHub Advisory
- [3]MITRE