GHSA-jv7x-xhv2-p5v2
Suggest an improvement- Source
- https://github.com/advisories/GHSA-jv7x-xhv2-p5v2
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-jv7x-xhv2-p5v2/GHSA-jv7x-xhv2-p5v2.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-jv7x-xhv2-p5v2
- Aliases
- Published
- 2025-07-14T21:22:01Z
- Modified
- 2025-07-15T01:20:13.800225Z
- Severity
-
- 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- LaRecipe is vulnerable to Server-Side Template Injection attacks
- Details
-
Impact
Attackers could: 1. Execute arbitrary commands on the server 2. Access sensitive environment variables 3. Escalate access depending on server configuration
A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection (SSTI), potentially leading to Remote Code Execution (RCE) in vulnerable configurations.
Patches
Users are strongly advised to upgrade to version v2.8.1 or later.
- Database specific
{ "github_reviewed_at": "2025-07-14T21:22:01Z", "cwe_ids": [ "CWE-1336" ], "nvd_published_at": "2025-07-14T23:15:24Z", "severity": "CRITICAL", "github_reviewed": true }- References
-
- https://github.com/saleem-hadad/larecipe/security/advisories/GHSA-jv7x-xhv2-p5v2
- https://nvd.nist.gov/vuln/detail/CVE-2025-53833
- https://github.com/saleem-hadad/larecipe/pull/390
- https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b
- https://github.com/saleem-hadad/larecipe
Affected packages
Packagist / binarytorch/larecipe
Package
- Name
- binarytorch/larecipe
- Purl
- pkg:composer/binarytorch/larecipe