CVE-2025-53833: LaRecipe is vulnerable to Server-Side Template Injection attacks
Impact Attackers could: 1. Execute arbitrary commands on the server 2. Access sensitive environment variables 3. Escalate access depending on server configuration A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection (SSTI), potentially leading to Remote Code Execution (RCE) in vulnerable configurations.
Published Jul 14, 2025 · Updated Jul 28, 2025
Affected packages
binarytorch/larecipe
- Ecosystem
- Composer (PHP)
- Affected
- < 2.8.1
- Fixed in
- 2.8.1
- Check
composer show binarytorch/larecipe
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Attackers could:
- Execute arbitrary commands on the server
- Access sensitive environment variables
- Escalate access depending on server configuration
A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection (SSTI), potentially leading to Remote Code Execution (RCE) in vulnerable configurations.
Patches
Users are strongly advised to upgrade to version v2.8.1 or later.
Credit
We would like to thank Roman Ananev for responsibly identifying and reporting this vulnerability.
References
- https://github.com/saleem-hadad/larecipe/security/advisories/GHSA-jv7x-xhv2-p5v2
- https://github.com/saleem-hadad/larecipe/pull/390
- https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b
- https://nvd.nist.gov/vuln/detail/CVE-2025-53833
- https://github.com/advisories/GHSA-jv7x-xhv2-p5v2
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology