Mustache remote code injection vulnerability

HIGH 8.8CVE-2022-0323 · GHSA-4rmr-c2jx-vx27 · Published 21/01/2022 · updated 17/06/2026

In short

CVE-2022-0323 is a HIGH (CVSS 8.8) vulnerability affecting mustache/mustache, mustache (mustache project).
Chance of exploitation in the next 30 days (EPSS): 0.67%, higher than 52.3% of all vulnerabilities.
Fix: update to 2.14.1 or later.

Package	Affected versions	Patched versions
mustache/mustache Packagist	`≥ 2.0.0, < 2.14.1`	`2.14.1`
mustache mustache_project	`≥ 2.0.0, < 2.14.1`	`2.14.1`

Description

In Mustache.php v2.0.0 through v2.14.0, Sections tag can lead to arbitrary php code execution even if strict_callables is true when section value is controllable.

NVD description

Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.

References

nvd.nist.gov/vuln/detail/CVE-2022-0323 · ADVISORY
bobthecow/mustache.php commit 579ffa5 · WEB
FriendsOfPHP/security-advisories · WEB
bobthecow/mustache.php · PACKAGE
bobthecow/mustache.php release v2.14.1 · WEB
huntr.dev/bounties/a5f5a988-aa52-4443-839d-299a63f44fb7 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free