Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/{recipe_name}" endpoint is rendered in the frontend without proper escaping leading to persistent XSS.
References
| Link | Resource |
|---|---|
| https://github.com/B1tBreaker/CVE-2025-56795 | Exploit |
| https://github.com/mealie-recipes/mealie/issues/5677 | Exploit Issue Tracking |
| https://github.com/mealie-recipes/mealie/pull/5754 | Issue Tracking Patch |
Configurations
History
16 Oct 2025, 15:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mealie mealie
Mealie |
|
| CPE | cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:* | |
| References | () https://github.com/B1tBreaker/CVE-2025-56795 - Exploit | |
| References | () https://github.com/mealie-recipes/mealie/issues/5677 - Exploit, Issue Tracking | |
| References | () https://github.com/mealie-recipes/mealie/pull/5754 - Issue Tracking, Patch |
01 Oct 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.0 |
30 Sep 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/{recipe_name}" endpoint is rendered in the frontend without proper escaping leading to persistent XSS. |
29 Sep 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CWE | CWE-79 |
29 Sep 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-29 17:15
Updated : 2025-10-16 15:42
NVD link : CVE-2025-56795
Mitre link : CVE-2025-56795
CVE.ORG link : CVE-2025-56795
JSON object : View
Products Affected
mealie
- mealie
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')