Vulnerability details
CVE-2025-23211
TandoorRecipes recipes
Tandoor Recipes - SSTI - Remote Code Execution
CVSS 3.1
10.0Critical
Official description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TandoorRecipes | recipes | < 1.5.24 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/TandoorRecipes/recipes/commit/e6087d5129cc9d0c24278948872377e66c2a2c20 x_refsource_MISC
- https://github.com/TandoorRecipes/recipes/blob/4f9bff20c858180d0f7376de443a9fe4c123a50c/cookbook/helper/template_helper.py#L95 x_refsource_MISC
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-r6rj-h75w-vj8v x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-01-28
- Last updated
- 2025-01-28
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
3.66%
Probability of exploitation in 30 days
89.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-1336Improper Neutralization of Special Elements Used in a Template Engine