Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-35046Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)

Medium 5.4

In plain English

A medium-severity cross-site scripting in recipes from TandoorRecipes. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 92.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary <style> tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the <style> tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. This vulnerability is fixed in 2.6.4.

Affected products (as reported)

Vendor	Product	Versions
TandoorRecipes	recipes	< 2.6.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9hhh-g2fc-r8x2 x_refsource_CONFIRM
https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 x_refsource_MISC