Back to overview

CVE-2025-23211

CRITICAL Exploitation: PoC
10.0
CVSS 3.1
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.

Metadata

CVE ID
CVE-2025-23211
State
PUBLISHED
Assigner
GitHub_M
Reserved
2025-01-13 17:15 UTC
Published
2025-01-28 15:24 UTC
Last updated
2025-01-28 16:15 UTC
Primary CWE
CWE-1336
CWE-1336: Improper Neutralization of Special Elements Used i…
Vendor / Product
TandoorRecipes / recipes
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
TandoorRecipes recipes — < 1.5.24
Weakness (CWE)
CWESourceDescription
CWE-1336 cna CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References (3)
Back to overview