Sander Ferdinand

**Name of the Vulnerable Software and Affected Versions** Frappe Framework ERPNext version 13.4.0 **Description** A sandbox escape in RestrictedPython allows authenticated users with the System Manager role to execute arbitrary code through frame introspection. An attacker can create a server script using the '/app/server-script' endpoint and access the `gi frame` attribute to traverse the call stack and invoke `os.popen()` to execute system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.