CVE-2025-53833

LaRecipe is a tool developers use to build documentation websites written in Markdown. This flaw is like a reception desk that executes any instructions written on a visitor's form instead of just reading it — a stranger can submit text that gets run as a command on your server, giving them control of it.

This matters to you if your business runs a documentation site built with LaRecipe (binarytorch/larecipe) — for example, internal wikis or public API/product docs built on Laravel. The flaw requires no login and no user interaction, so any exposed LaRecipe instance below version 2.8.1 is at risk if it's reachable from the internet.

This is a critical flaw that lets attackers run commands on your server without needing a password, so it deserves prompt attention even though there's no confirmed active exploitation or government warning about it yet. A working detection method exists publicly, which increases the chance of exploitation attempts. Treat this as a priority to fix in the near term, not an emergency to drop everything for tonight.

Confirm exposure by checking the installed version of binarytorch/larecipe via composer.lock or composer show binarytorch/larecipe. Any version prior to 2.8.1 is vulnerable to unauthenticated SSTI in the Markdown rendering pipeline, leading to potential RCE depending on server configuration (PHP functions enabled, sandboxing, etc.). Upgrade to binarytorch/larecipe >= 2.8.1, which patches the template injection vector. Review the changelog for 2.8.1 for any breaking changes to custom Markdown extensions or theming before deploying to production. If immediate upgrade isn't possible, place the documentation routes behind authentication or a WAF rule blocking template-injection payload patterns (e.g., {{ }}, ${...}, #{...}) as a temporary mitigation. Monitor web server and application logs for anomalous POST requests to documentation/markdown rendering endpoints, unexpected child processes spawned by the PHP-FPM/web server user, and outbound connections from the app server. No CISA KEV listing exists currently, but exploit tooling (detection template) is already public, so prioritize remediation within your normal critical-patch SLA.

CVSS 3.1 score of 10.0 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects network-exploitable, no privileges or interaction required, scope change, and complete loss of confidentiality, integrity, and availability. Weakness class is CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), enabling Server-Side Template Injection in LaRecipe's Markdown rendering, escalating to RCE depending on server configuration. Not listed in CISA KEV; EPSS places exploitation likelihood in a notably elevated percentile relative to all scored CVEs, though trending downward, and should not be treated as confirmed exploitation. Exploit maturity is limited to a known detection template rather than a full weaponized exploit chain, consistent with pre-mass-exploitation status. Fixed in binarytorch/larecipe 2.8.1.