Vulnerability Database

319,897

Total vulnerabilities in the database

CVE-2025-56795

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/{recipe_name}" endpoint is rendered in the frontend without proper escaping leading to persistent XSS.

  • Published: Sep 29, 2025
  • Updated: Nov 16, 2025
  • CVE: CVE-2025-56795
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9
  • AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWEs:

OWASP TOP 10:

Software From Fixed in
mealie / mealie - 3.0.1.x