Critical severity · published Jan 28, 2025
CVE-2025-23211
Tandoor Recipes - SSTI - Remote Code Execution
9.9
CVSS
3.6%
EPSS
No
On KEV
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
recipes · TandoorRecipes
< 1.5.24 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-23211
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-23211
Product
https://github.com/TandoorRecipes/recipes/blob/4f9bff20c858180d0f7376de443a9fe4c123a50c/cookbook/helper/template_helper.py#L95
Patch
https://github.com/TandoorRecipes/recipes/commit/e6087d5129cc9d0c24278948872377e66c2a2c20
Exploit
https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-r6rj-h75w-vj8v
More from recipes
8.1
CVE-2026-61726
Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
8.1
CVE-2026-35488
Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users
8.1
CVE-2026-35045
Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification
8.1
CVE-2026-33149
Tandoor Recipes Vulnerable to Host Header Injection
7.7
CVE-2026-115810
Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL