Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

frappe/frappe

              develop @ b08d17d
            

502

Fixes

CVEs

CRITICAL

Peak severity

19.4%

Coverage

Highlights

Auth Bypass: 247 prior fixes. Scrutinize any change in this area.

frappe/model/db_query.py: most-fixed (58 issues). Treat as high-risk during review.

308 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: The dynamic DatabaseQuery engine has historically been vulnerable to SQL injection via unvalidated columns, order_by/group_by clauses, and naive keyword blocklists that could be bypassed with comments, whitespace variations, and nested subqueries. Attackers can execute arbitrary SQL commands remotely.

Auth Bypass: Remote client-facing APIs like set_value, get_count, and bulk_update regularly leaked permissions by allowing users to overwrite internal flags, modify un-validated child tables, or leverage whitelisted wrappers that bypassed standard document authorization checks.

Stored XSS: Raw HTML interpolation of version change comments and field styling in the document timeline has recurrently permitted stored XSS. An authenticated attacker can inject malicious payloads via document modifications that execute when another user views the timeline.