PT-2025-4850 · Docker · Docker Compose

M10X · Published 2025-01-28 · Updated 2026-04-21 · CVE-2025-23211

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Tandoor Recipes versions prior to 1.5.24

Description: The issue is related to a Jinja2 SSTI vulnerability that allows any user to execute commands on the server, potentially with root privileges in the case of the provided Docker Compose file. This vulnerability has been fixed in version 1.5.24.

Recommendations: Tandoor Recipes versions prior to 1.5.24: Update to version 1.5.24 to fix the Jinja2 SSTI vulnerability.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

CVE-2025-23211

GHSA-R6RJ-H75W-VJ8V

Affected Products

Docker Compose

References · 12

• 🔥 https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-r6rj-h75w-vj8v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23211.json · Exploit
• https://github.com/TandoorRecipes/recipes/commit/e6087d5129cc9d0c24278948872377e66c2a2c20 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-23211 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23211 · Vendor Advisory
• https://github.com/TandoorRecipes/recipes/blob/4f9bff20c858180d0f7376de443a9fe4c123a50c/cookbook/helper/template_helper.py#L95 · Note
• https://twitter.com/CVEnew/status/1884265627055223144 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2046484112857530851 · Twitter Post
• https://twitter.com/offsectraining/status/1920571609548529746 · Twitter Post
• https://t.me/latest_high_impact_cve/1779 · Telegram Post
• https://t.me/cvedetector/16612 · Telegram Post
• https://twitter.com/CveFindCom/status/1884263198225805652 · Twitter Post