CVE-2025-23211

The vulnerability results from unsafe processing of user input by the Jinja2 template engine without proper sanitization (CWE-1336, CWE-94). An attacker can inject a malicious payload in the form of template expressions, which will be interpreted and executed on the server side. Since the deployment based on the provided Docker Compose file runs the application as root, code execution takes place with the highest privileges in the container.

An attacker with basic access to the application (any user account) can execute arbitrary system commands on the server, leading to complete takeover of the environment — including data reading and modification, container compromise, and potential lateral movement in the infrastructure.

Tandoor Recipes should be updated to version 1.5.24 or newer as soon as possible, in which the vulnerability has been removed (commit e6087d5129cc9d0c24278948872377e66c2a2c20). Additionally, it is recommended to review container configuration to ensure application processes run without root privileges.

Tandoor Recipes in versions prior to 1.5.24, particularly deployments using the Docker Compose file provided by the vendor