CVE-2025-53833 LaRecipe is vulnerable to Server-Side Template Injection attacks
Attackers can execute arbitrary code via Server-Side Template Injection in LaRecipe, potentially escalating privileges on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53833?
CVE-2025-53833 is a critical code injection vulnerability in saleem-hadad larecipe, published on 14 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
Weakness: CWE-1336
Which versions are affected by CVE-2025-53833?
2 open source packages ship an affected version, including binarytorch/larecipe.
| Package | Affected | Fixed in |
|---|---|---|
binarytorch/larecipe Packagist | All versions | 2.8.1 |
binarytorch/larecipe Packagist | All versions | 2.8.1 |
How do I fix CVE-2025-53833?
Upgrade binarytorch/larecipe to 2.8.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-53833 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53833 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-jv7x-xhv2-p5v2.