GHSA-jv7x-xhv2-p5v2
Suggest an improvement- Source
- https://github.com/advisories/GHSA-jv7x-xhv2-p5v2
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-jv7x-xhv2-p5v2/GHSA-jv7x-xhv2-p5v2.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-jv7x-xhv2-p5v2
- Aliases
- Published
- 2025-07-14T21:22:01Z
- Modified
- 2025-07-28T17:19:22Z
- Severity
-
- 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- LaRecipe is vulnerable to Server-Side Template Injection attacks
- Details
-
Impact
Attackers could:
- Execute arbitrary commands on the server
- Access sensitive environment variables
- Escalate access depending on server configuration
A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection (SSTI), potentially leading to Remote Code Execution (RCE) in vulnerable configurations.
Patches
Users are strongly advised to upgrade to version v2.8.1 or later.
Credit
We would like to thank Roman Ananev for responsibly identifying and reporting this vulnerability.
- Database specific
{ "cwe_ids": [ "CWE-1336" ], "github_reviewed": true, "github_reviewed_at": "2025-07-14T21:22:01Z", "nvd_published_at": "2025-07-14T23:15:24Z", "severity": "CRITICAL" }- References
-
- https://github.com/saleem-hadad/larecipe/security/advisories/GHSA-jv7x-xhv2-p5v2
- https://nvd.nist.gov/vuln/detail/CVE-2025-53833
- https://github.com/saleem-hadad/larecipe/pull/390
- https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b
- https://github.com/saleem-hadad/larecipe
Affected packages
Packagist / binarytorch/larecipe
Package
- Name
- binarytorch/larecipe
- Purl
- pkg:composer/binarytorch/larecipe
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.8.1