CVE-2025-56795 in Mealie

Riassunto

di MITRE • 29/09/2025

Mealie 3.0.1 and earlier is vulnerable to Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/{recipe_name}" endpoint is rendered in the frontend without proper escaping leading to persistent XSS.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsabile: MITRE
• Prenotare: 17/08/2025
• Divulgazione: 29/09/2025
• Moderazione: accettato
• Voce: VDB-326253
• CPE: pronto
• CWE: CWE-79 (confermato)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00340
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-56795
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-56795
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-56795/