CVE-2025-56795
BaseFortify
Publication date: 2025-09-29
Last updated on: 2025-10-16
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mealie | mealie | to 3.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a persistent Cross-Site Scripting (XSS) issue in Mealie versions 3.0.1 and earlier. It occurs in the recipe creation functionality where user input in the 'note' and 'text' fields of the recipe API endpoint is not properly sanitized or escaped. As a result, malicious users can inject arbitrary HTML or JavaScript code that gets stored and later executed in the frontend when the recipe is viewed, potentially allowing attackers to run scripts in other users' browsers. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary JavaScript in the context of the affected application. This can lead to theft of user session data, defacement of the application interface, redirection to malicious sites, or other malicious actions performed on behalf of the user. Since the XSS is persistent, the malicious code remains stored and executes whenever the affected recipe is viewed, increasing the risk and impact. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to create or update a recipe in Mealie with malicious JavaScript payloads in the 'note' and 'text' fields of the /api/recipes/{recipe_name} endpoint and then observing if the payload executes when viewing the recipe. A practical approach is to use curl or similar HTTP clients to send crafted JSON data with script tags in these fields and then check the frontend for script execution or inspect the JSON response for unsanitized input. For example, you can use a curl command to POST a recipe with a payload like '<script>alert(1)</script>' in the note or text fields and then view the recipe in the frontend to see if the alert triggers. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating Mealie to a version that includes the patch merged on July 20, 2025, which sanitizes and escapes all user input in the affected fields to prevent XSS. If updating is not immediately possible, restrict access to the recipe creation functionality to trusted users only, and avoid entering untrusted input in the 'note' and 'text' fields. Additionally, consider implementing web application firewall (WAF) rules to detect and block common XSS payloads targeting these endpoints. [1]