Critical severity9.9NVD Advisory· Published Jan 28, 2025· Updated Jun 17, 2026

CVE-2025-23211

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Tandoor/Recipes2 versions
cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*range: <1.5.24
- (no CPE)range: <1.5.24
TandoorRecipes/Recipescpe-rescue
Range: < 1.5.24

Patches

Vulnerability mechanics

References

github.com/TandoorRecipes/recipes/commit/e6087d5129cc9d0c24278948872377e66c2a2c20nvdPatch
github.com/TandoorRecipes/recipes/security/advisories/GHSA-r6rj-h75w-vj8vnvdExploitVendor Advisory
github.com/TandoorRecipes/recipes/blob/4f9bff20c858180d0f7376de443a9fe4c123a50c/cookbook/helper/template_helper.pynvdProduct

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000