Every CVE Search/ Get API key

CVE-2022-21648

Sandbox bypass in Latte templates

8.2 HighFix available

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.84%Unchanged since Feb 8, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.2

Sandbox bypass in Latte templates

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

Record
CVE-2022-21648
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2022-0431 8.2

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

Record
EUVD-2022-0431
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-36m2-8rhx-f36j 8.2

Sandbox bypass in Latte templates

Impact

The problem affects users who use the sandbox in Latte and templates from untrusted sources.

Patches

Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8.

References

The issues were discovered by

Record
GHSA-36m2-8rhx-f36j
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 8.2

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

Record
CVE-2022-21648
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 8.2

Sandbox bypass in Latte templates

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

Record
CVE-2022-21648
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-36m2-8rhx-f36j 8.2

Sandbox bypass in Latte templates

Impact

The problem affects users who use the sandbox in Latte and templates from untrusted sources.

Patches

Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8.

References

The issues were discovered by

Record
GHSA-36m2-8rhx-f36j
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2022-21648 8.2

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

Record
UBUNTU-CVE-2022-21648
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
latte/latte
Packagist
 2.10.0 up to 2.10.8
2.10.8
latte/latte
Packagist
 2.9.0 up to 2.9.6
2.9.6
latte/latte
Packagist
 2.8.0 up to 2.8.8
2.8.8
latte/latte
Packagist
 2.10.0 up to 2.10.8, plus listed versions
v2.10.1v2.10.2v2.10.3v2.10.4v2.10.5v2.10.6v2.10.7
2.10.8
latte/latte
Packagist
 2.9.0 up to 2.9.6, plus listed versions
v2.9.0v2.9.1v2.9.2v2.9.3v2.9.4v2.9.5
2.9.6
latte/latte
Packagist
 2.8.0 up to 2.8.8, plus listed versions
v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5v2.8.6v2.8.7
2.8.8
php-nette
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.3.4-12.3.5-12.3.7-12.3.8-12.3.8-1ubuntu12.3.8-1ubuntu1+esm1
 None known
php-nette
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.4-20160731-12.4-20160731-1ubuntu0.1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21648 is a high vulnerability (CVSS 8.2) in Nette Latte, published January 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in latte/latte 2.10.8.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open