CVE-2025-53833

Deeper analysis

LaRecipe is a documentation tool that renders Markdown content inside Laravel applications. Versions prior to 2.8.1 contain a Server-Side Template Injection vulnerability (CWE-1336) that can result in remote code execution when the application is deployed with certain template or configuration settings enabled. The flaw received a CVSS 3.1 score of 10.0, reflecting network-accessible, unauthenticated attack paths with high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted Markdown input that is processed by the template engine, allowing execution of arbitrary commands on the underlying server, disclosure of environment variables, or further privilege escalation depending on the runtime configuration. Because the vector requires no user interaction or credentials, any publicly reachable LaRecipe instance prior to the fix is exposed.

The project’s GitHub security advisory and associated pull request direct users to upgrade immediately to version 2.8.1 or later, where the injection issue has been addressed through the commit that sanitizes template input. The referenced advisory (GHSA-jv7x-xhv2-p5v2) and patch commit provide the concrete remediation steps.

EPSS for the CVE reached a peak of 0.3215 on 2026-02-18 before receding to the current value of 0.2082, indicating a period of elevated exploitation interest after disclosure. No information on observed in-the-wild exploitation is supplied in the available references.