GHSA-36m2-8rhx-f36j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-36m2-8rhx-f36j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-36m2-8rhx-f36j/GHSA-36m2-8rhx-f36j.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-36m2-8rhx-f36j
- Aliases
- Published
- 2022-01-06T23:17:07Z
- Modified
- 2023-11-01T04:57:39Z
- Severity
-
- 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
- Summary
- Sandbox bypass in Latte templates
- Details
-
Impact
The problem affects users who use the sandbox in Latte and templates from untrusted sources.
Patches
Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8.
References
The issues were discovered by
- JinYiTong (https://github.com/JinYiTong)
- 赵钰迪 20212010122@fudan.edu.cn
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2022-01-06T19:42:15Z", "nvd_published_at": "2022-01-04T20:15:00Z", "severity": "HIGH" }- References
Affected packages
Packagist / latte/latte
Package
- Name
- latte/latte
- Purl
- pkg:composer/latte/latte
Packagist / latte/latte
Package
- Name
- latte/latte
- Purl
- pkg:composer/latte/latte
Packagist / latte/latte
Package
- Name
- latte/latte
- Purl
- pkg:composer/latte/latte