CVE-2025-23211 is a critical (CVSS 9.9) server-side template injection in Tandoor Recipes, the self-hosted recipe and meal planning app. Any signed in user could make the server run commands through Jinja2 templates. Versions up to 1.5.23 are affected and 1.5.24 contains the fix.
What's affected
The GitHub advisory GHSA-r6rj-h75w-vj8v for Tandoor Recipes (listed as GHSA-r6rj-h75w-vj8v) lists affected versions up to and including 1.5.23 and the patched version as 1.5.24. The vector is AV:N/AC:L/PR:L with a changed scope, so any user with an account is enough, and impact extends beyond the application itself.
The advisory notes that in the project's provided Docker Compose file the application runs as root, which raises the stakes for people who followed the default setup. The weak code is in cookbook/helper/template_helper.py, where user input is placed into a template without sanitizing.
How to check if you're exposed
Find the running version from the app's about page or from the container image tag:
docker ps --format '{{.Image}}' | grep -i recipes
docker inspect <container> | grep -i version
Anything at or below 1.5.23 needs the upgrade. Because the flaw needs an account, also list your users. A family instance with a few trusted people has a lower practical risk than one with open sign up.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade Tandoor Recipes to 1.5.24 or later and recreate the containers.
- Disable open registration if you do not need it.
- Review recipes for unexpected template syntax in instructions if you ran an old version with many users.
- Run the container as a non root user where the image allows it, and keep the host's Docker socket out of the container.
- Rotate the application secret key and database credentials if you suspect misuse, since the advisory says secrets can be exposed.
Why it matters
CWE-1336 is improper neutralization of special elements in a template engine, and CWE-94 is code injection. Tandoor lets users write recipe instructions and then renders them through Jinja2. When user text is treated as template code rather than plain data, the template engine can reach functions in the Python runtime.
The advisory author notes that markdown conversion made exploitation harder than copying a known payload, but not impossible. This blog does not repeat the details. The fix is to render user content as data, or to use a sandboxed template environment. The KEV flag is false and no exploitation is claimed.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-23211?
Tandoor Recipes 1.5.24. Versions up to and including 1.5.23 are affected.
Why is the score so high for an app that needs a login?
The impact is command execution on the server and the scope changes, and in the default Docker Compose file the app runs as root.
Sources
Last reviewed: 19 October 2026.
