Vulnerability · Published Jan 4, 2022 · Assigned by GitHub_M

CVE-2022-21648Sandbox bypass in Latte templates

High 8.2

In plain English

A high-severity cross-site scripting in latte from nette. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.8%top 41.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	latte/latte	2.10.8	GHSA-36m2-8rhx-f36j
Packagist	latte/latte	2.9.6	GHSA-36m2-8rhx-f36j
Packagist	latte/latte	2.8.8	GHSA-36m2-8rhx-f36j

Affected products (as reported)

Vendor	Product	Versions
nette	latte	>= 2.10.0, < 2.10.8>= 2.9.0, < 2.9.6>= 2.8.0, < 2.8.8

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

https://github.com/nette/latte/security/advisories/GHSA-36m2-8rhx-f36j x_refsource_CONFIRM
https://github.com/nette/latte/commit/9e1b4f7d70f7a9c3fa6753ffa7d7e450a3d4abb0 x_refsource_MISC