CVE-2022-21648 HIGH

CVE-2022-21648: Sandbox bypass in Latte templates

Vendor Nette
Product latte
Weakness CWE-79 · XSS
Published January 4, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

Key dates

02Disclosure timeline

January 4, 2022 CVE published
April 23, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-23868 WordPress Chess Tempo Viewer plugin <= 0.9.5 - Stored Cross Site Scripting (XSS) vulnerability CVE-2024-5737 HTML Injection in AdmirorFrames Joomla! Extension CVE-2024-7068 SourceCodester Insurance Management System update_sub_category cross site scripting CVE-2026-1807 InteractiveCalculator for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute CVE-2023-2153 SourceCodester Complaint Management System POST Parameter editable_ajax.php cross site scripting