GitHub Advisoryadvisory · Packagist

GHSA-36m2-8rhx-f36j Sandbox bypass in Latte templates

HIGH Published 2022-01-06 Modified 2022-01-14 Official page ↗
Aliases
CVE-2022-21648
Ecosystem
Packagist
Packages
latte/latte
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-01-06

Affected packages

• Packagist latte/latte: >= 2.10.0, < 2.10.8 → fixed in 2.10.8 • Packagist latte/latte: >= 2.9.0, < 2.9.6 → fixed in 2.9.6 • Packagist latte/latte: >= 2.8.0, < 2.8.8 → fixed in 2.8.8

Description

Impact The problem affects users who use the sandbox in Latte and templates from untrusted sources. Patches Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. References The issues were discovered by • JinYiTong (https://github.com/JinYiTong) • 赵钰迪

Related

Alias · CVE (1)

  • CVE-2022-21648 Latte is an open source template engine for PHP. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References