CVE-2025-53833

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

LaRecipe is a documentation tool that renders Markdown content inside Laravel applications. Versions prior to 2.8.1 contain a Server-Side Template Injection vulnerability (CWE-1336) that can result in remote code execution when the application is deployed with certain template or configuration settings enabled. The flaw received a CVSS 3.1 score of 10.0, reflecting network-accessible, unauthenticated attack paths with high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted Markdown input that is processed by the template engine, allowing execution of arbitrary commands on the underlying server, disclosure of environment variables, or further privilege escalation depending on the runtime configuration. Because the vector requires no user interaction or credentials, any publicly reachable LaRecipe instance prior to the fix is exposed.

The project’s GitHub security advisory and associated pull request direct users to upgrade immediately to version 2.8.1 or later, where the injection issue has been addressed through the commit that sanitizes template input. The referenced advisory (GHSA-jv7x-xhv2-p5v2) and patch commit provide the concrete remediation steps.

EPSS for the CVE reached a peak of 0.3215 on 2026-02-18 before receding to the current value of 0.2082, indicating a period of elevated exploitation interest after disclosure. No information on observed in-the-wild exploitation is supplied in the available references.