Read the docs
TI-2025-33725 Aliases CVE-2025-53833GHSA-jv7x-xhv2-p5v2

LaRecipe is vulnerable to Server-Side Template Injection attacks

Priority MEDIUM 61CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.09141 95th percentileScored 2026-11-07
Fix Fixed larecipe (saleem-hadad): 2.8.1binarytorch/larecipe (Packagist): 2.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
saleem-hadadlarecipebefore 2.8.12.8.1Patch availableCNA
—binarytorch/larecipe (Packagist)before 2.8.12.8.1Patch availableGHSA-jv7x-xhv2-p5v2
  • larecipe Vendorsaleem-hadad Affected before 2.8.1 Fixed in 2.8.1 Patch available CNA
  • binarytorch/larecipe (Packagist) Vendor— Affected before 2.8.1 Fixed in 2.8.1 Patch available GHSA-jv7x-xhv2-p5v2

Remediation

  • Fix · CNA larecipe (saleem-hadad) Fixed in 2.8.1
  • Fix · GHSA-jv7x-xhv2-p5v2 binarytorch/larecipe (Packagist) Fixed in 2.8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53833
  2. 2026-10-03 Alias added: GHSA-jv7x-xhv2-p5v2

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences