GHSA-jv7x-xhv2-p5v2CriticalCVSS 10.0

LaRecipe is vulnerable to Server-Side Template Injection attacks

Published
July 14, 2025
Last Modified
July 28, 2025

🔗 CVE IDs covered (1)

CVE-2025-53833 →

📋 Description

Impact

Attackers could:

  1. Execute arbitrary commands on the server
  2. Access sensitive environment variables
  3. Escalate access depending on server configuration

A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection (SSTI), potentially leading to Remote Code Execution (RCE) in vulnerable configurations.

Patches

Users are strongly advised to upgrade to version v2.8.1 or later.

Credit

We would like to thank Roman Ananev for responsibly identifying and reporting this vulnerability.

🎯 Affected products1

  • composer/binarytorch/larecipe:< 2.8.1

🔗 References (5)