A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Feb 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Mealie-recipes
Mealie-recipes mealie |
|
| Vendors & Products |
Mealie-recipes
Mealie-recipes mealie |
Wed, 11 Feb 2026 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view. | |
| References |
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-02-11T18:28:33.828Z
Reserved: 2026-01-09T00:00:00.000Z
Link: CVE-2025-70296
No data.
Status : Awaiting Analysis
Published: 2026-02-11T19:15:50.580
Modified: 2026-02-12T15:10:37.307
Link: CVE-2025-70296
No data.
OpenCVE Enrichment
Updated: 2026-02-12T11:19:27Z
Weaknesses
No weakness.