Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute …

Frappe Framework ERPNext 13.4.0 contains a critical sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code. The vulnerability exploits frame introspection through the gi_frame attribute to traverse the call stack and invoke os.popen for system command execution. Attackers can leverage the /app/server-script endpoint to create malicious server scripts. This represents a significant security risk as it allows privilege escalation and complete system compromise for authenticated users with elevated roles.