HIGH8.2

GHSA-36m2-8rhx-f36j

Sandbox bypass in Latte templates

Quick fix

GHSA-36m2-8rhx-f36j — latte/latte: upgrade to the fixed version with the command below.

composer require latte/latte:^2.10.8

Details

### Impact The problem affects users who use the sandbox in Latte and templates from untrusted sources.

### Patches Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8.

### References The issues were discovered by - JinYiTong (https://github.com/JinYiTong) - 赵钰迪 <20212010122@fudan.edu.cn>

Enter the version of the package you're using.

Introduced in: 2.10.0Fixed in: 2.10.8

Fixcomposer require latte/latte:^2.10.8

Introduced in: 2.9.0Fixed in: 2.9.6

Fixcomposer require latte/latte:^2.9.6

Introduced in: 2.8.0Fixed in: 2.8.8

Fixcomposer require latte/latte:^2.8.8