Sandbox bypass in Latte templates
Priority LOW 37CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00844 58th percentileScored 2026-11-07
Fix Fixed latte (nette): 2.10.8, 2.9.6, 2.8.8latte/latte (Packagist): 2.10.8, 2.9.6, 2.8.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nette | latte | 2.10.0 to before 2.10.8; 2.9.0 to before 2.9.6; 2.8.0 to before 2.8.8 | 2.10.8, 2.9.6, 2.8.8 | Patch available | CNA |
| — | latte/latte (Packagist) | 2.10.0 to before 2.10.8 | 2.10.8 | Patch available | GHSA-36m2-8rhx-f36j |
| — | latte/latte (Packagist) | 2.9.0 to before 2.9.6 | 2.9.6 | Patch available | GHSA-36m2-8rhx-f36j |
| — | latte/latte (Packagist) | 2.8.0 to before 2.8.8 | 2.8.8 | Patch available | GHSA-36m2-8rhx-f36j |
- latte Vendornette Affected 2.10.0 to before 2.10.8; 2.9.0 to before 2.9.6; 2.8.0 to before 2.8.8 Fixed in 2.10.8, 2.9.6, 2.8.8 Patch available CNA
- latte/latte (Packagist) Vendor— Affected 2.10.0 to before 2.10.8 Fixed in 2.10.8 Patch available GHSA-36m2-8rhx-f36j
- latte/latte (Packagist) Vendor— Affected 2.9.0 to before 2.9.6 Fixed in 2.9.6 Patch available GHSA-36m2-8rhx-f36j
- latte/latte (Packagist) Vendor— Affected 2.8.0 to before 2.8.8 Fixed in 2.8.8 Patch available GHSA-36m2-8rhx-f36j
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nette:latte:*:*:*:*:*:*:*:* | 2.8.0 to before 2.8.8; 2.9.0 to before 2.9.6; 2.10.0 to before 2.10.8 | Vulnerable | nette |
- cpe:2.3:a:nette:latte:*:*:*:*:*:*:*:* Versions 2.8.0 to before 2.8.8; 2.9.0 to before 2.9.6; 2.10.0 to before 2.10.8 Vulnerable ·nette
Remediation
- Fix · CNA latte (nette) Fixed in 2.10.8, 2.9.6, 2.8.8
- Fix · GHSA-36m2-8rhx-f36j latte/latte (Packagist) Fixed in 2.10.8 Advisory →
- Fix · GHSA-36m2-8rhx-f36j latte/latte (Packagist) Fixed in 2.9.6 Advisory →
- Fix · GHSA-36m2-8rhx-f36j latte/latte (Packagist) Fixed in 2.8.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21648
- 2026-10-03 Alias added: GHSA-36m2-8rhx-f36j
References
More nette Latte vulnerabilities
- TI-2021-06193 Access control bypass in latte/latte CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-21648 · CVE Program
- CVE-2022-21648 · NVD
- FIRST EPSS
- GHSA-36m2-8rhx-f36j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences