Latte is an open source template engine for PHP. A sandbox escape exists in the template sandbox, allowing for injection into web pages generated from Latte, which may lead to XSS attacks. The issue affects users who use the sandbox in Latte and templates from untrusted sources.