CVE-2026-41581: Frappe Unvalidated Dict Key Childquerycve-2026-41581-frappe-unvalidated-dict-key-childquery
Bypass of field validation for dictionary keys passed to ChildQuery. If dictionary keys from user-controlled JSON are passed without validation, attackers can inject SQL or call unauthorized SQL functions. Validate keys (e.g., check string properties or reject uppercase) before using them as field names.
