saleem-hadad/larecipe · Security
LaRecipe is vulnerable to Server-Side Template Injection attacks
- GHSA ID
- GHSA-jv7x-xhv2-p5v2
- CVE ID
- CVE-2025-53833
- Severity
- critical
- Published
- Updated
- CVSS
- 10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
Impact
Attackers could:
- Execute arbitrary commands on the server
- Access sensitive environment variables
- Escalate access depending on server configuration
A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection (SSTI), potentially leading to Remote Code Execution (RCE) in vulnerable configurations.
Patches
Users are strongly advised to upgrade to version v2.8.1 or later.
Credit
We would like to thank Roman Ananev for responsibly identifying and reporting this vulnerability.
CWEs
- CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
References
- https://github.com/saleem-hadad/larecipe/security/advisories/GHSA-jv7x-xhv2-p5v2 ↗
- https://github.com/saleem-hadad/larecipe/pull/390 ↗
- https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-53833 ↗
- https://github.com/advisories/GHSA-jv7x-xhv2-p5v2 ↗