Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)

Tandoor Recipes allows authenticated users to inject malicious CSS code into recipe instructions, which gets stored and served to other users. This can be used to alter the appearance of the app, trick users into clicking fake links, or steal sensitive information.

Stored CSS injection via unsanitized <style> tags in recipe instructions exploited by authenticated attackers. The bleach.clean() sanitizer whitelists <style> tags, allowing arbitrary CSS payloads to persist in the database and be served via API. Clients rendering instructions_markdown as HTML without additional sanitization execute attacker-controlled CSS, enabling UI redressing, phishing attacks, and potential data exfiltration.