CVE-2026-35046mediumCWE-79

CVE-2026-35046: medium-severity vulnerability in TandoorRecipes recipes

Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)

Published · Updated

Follow this CVE+ Monitor recipes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.2%
In short

Tandoor Recipes allows authenticated users to inject malicious CSS code into recipe instructions, which gets stored and served to other users. This can be used to alter the appearance of the app, trick users into clicking fake links, or steal sensitive information.

Technical detail

Stored CSS injection via unsanitized <style> tags in recipe instructions exploited by authenticated attackers. The bleach.clean() sanitizer whitelists <style> tags, allowing arbitrary CSS payloads to persist in the database and be served via API. Clients rendering instructions_markdown as HTML without additional sanitization execute attacker-controlled CSS, enabling UI redressing, phishing attacks, and potential data exfiltration.

Summary generated and translated by AI from the official description.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary <style> tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the <style> tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. This vulnerability is fixed in 2.6.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
TandoorRecipes · recipes
Related CVEs — TandoorRecipes recipes

In the same product, most dangerous first.

CVE-2025-23211CRITICALTandoor Recipes - SSTI - Remote Code ExecutionEPSS 3.7%CVE-2025-23212HIGHTandoor Recipes - Local file disclosure - Users can read the content of any file on the serverEPSS 0.5%CVE-2026-33152CRITICALTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationEPSS 0.5%CVE-2026-25964MEDIUMTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadEPSS 0.5%CVE-2026-33148MEDIUMURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyEPSS 0.5%CVE-2026-33153HIGHTandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control LogicEPSS 0.5%