Latte · Latte · CVE-2022-21648
**Name of the Vulnerable Software and Affected Versions**
Latte versions 2.8.0 through 2.8.7
Latte versions 2.9.0 through 2.9.5
Latte versions 2.10.0 through 2.10.7
**Description**
Latte is an open source template engine for PHP. A sandbox escape exists in the template sandbox, allowing for injection into web pages generated from Latte, which may lead to XSS attacks. The issue affects users who use the sandbox in Latte and templates from untrusted sources.
**Recommendations**
For versions 2.8.0 through 2.8.7, update to version 2.8.8.
For versions 2.9.0 through 2.9.5, update to version 2.9.6.
For versions 2.10.0 through 2.10.7, update to version 2.10.8.
As a temporary workaround for users unable to upgrade, do not accept template input from untrusted sources.