GitHub Advisoryadvisory · Packagist

GHSA-jv7x-xhv2-p5v2 LaRecipe is vulnerable to Server-Side Template Injection attacks

CRITICAL Published 2025-07-14 Modified 2025-07-28 Official page ↗
Aliases
CVE-2025-53833
Ecosystem
Packagist
Packages
binarytorch/larecipe
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-1336
Reviewed
2025-07-14

Affected packages

• Packagist binarytorch/larecipe: < 2.8.1 → fixed in 2.8.1

Description

Impact Attackers could: 1. Execute arbitrary commands on the server 2. Access sensitive environment variables 3. Escalate access depending on server configuration A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection (SSTI), potentially leading to Remote Code Execution (RCE) in vulnerable configurations. Patches Users are strongly advised to upgrade to version v2.8.1 or later. Credit We would like to thank Roman Ananev for responsibly identifying and reporting this vulnerability.

Related

Alias · CVE (1)

  • CVE-2025-53833 LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. vulnerability

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References