high8.2
CVE-2022-21648
Sandbox bypass in Latte templates
Impact
### Impact The problem affects users who use the sandbox in Latte and templates from untrusted sources. ### Patches Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. ### References The issues were discovered by - JinYiTong (https://github.com/JinYiTong) - 赵钰迪 <20212010122@fudan.edu.cn>
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | latte/latte | >= 2.10.0, < 2.10.8 | 2.10.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nette | Latte | from 2.8.0 before 2.8.8 from 2.9.0 before 2.9.6 from 2.10.0 before 2.10.8 |