b1tbreaker/cve-2025-56795Stored Cross-Site Scripting (XSS) vulnerability affecting the recipe creation functionality in Mealie versions up to 3.0.1.
Two stored Cross-Site Scripting (XSS) vulnerabilities were identified in the recipe creation functionality of Mealie, affecting all versions up to and including 3.0.1.
Unsanitized user input provided during recipe creation is stored and later rendered in the frontend without proper escaping, resulting in persistent XSS.
During the creation of a new recipe, the following fields are vulnerable:
Ingredient Notes (note parameter):
Input in this field is stored and later rendered in the recipe detail view, allowing the execution of injected JavaScript payloads.
Instruction Text (text parameter):
Input in this field is also stored and rendered in the recipe detail view, leading to JavaScript execution when the recipe is viewed.
Screenshot showing the vulnerable parameters in the JSON response after creating a new recipe:
Browser alert triggered via the note parameter (“First Stored XSS”):
Browser alert triggered via the text parameter (“Second Stored XSS”):
