External risk intelligence

Mealie Recipe Creation Stored XSS Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2025-56795

Mealie is a self-hosted recipe manager. While it is a web application that can be exposed to the internet by users for remote access, it is primarily intended for personal or home-network use rather than being designed as a public-facing edge service or enterprise web application.

Cross-site Scripting

Mealie

3.0.1 and earlier

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Mealie, a self-hosted recipe management application, has a critical vulnerability in its recipe creation feature. This flaw allows for the injection of malicious scripts that can be persistently displayed to users, posing a significant security risk if the application is exposed externally. The main concern is confirming its relevance and potential exposure.

A security flaw allows malicious code in recipe notes.
It enables persistent script injection for visible users.
Confirm relevance and potential exposure to users.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by crafting a malicious recipe and submitting it through the application's API. Because the application does not properly sanitize user-provided notes and text when creating recipes, these specially crafted inputs are stored and later displayed on the user interface without adequate escaping. This can lead to arbitrary code execution within the context of a user's browser.

Requires authenticated access to create recipes.
Malicious input submitted via API.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

In Mealie, when a user with authenticated access creates a recipe, unsanitized input in the "note" and "text" fields of the recipe creation endpoint can be rendered on the frontend. This vulnerability could allow for persistent cross-site scripting when supported by the advisory.

User-provided recipe notes and text.
Malicious script injected into recipe fields.
Sensitive data may be exposed to attackers.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Mealie application, specifically versions up to and including 3.0.1, is vulnerable to stored cross-site scripting due to unsanitized user input in recipe creation. This threat requires immediate attention from the team responsible for managing the Mealie instance. The first practical step is to identify all instances of Mealie within the environment, assess their reachability and business criticality, and then determine the accountable owner for remediation planning.

Mealie instance owners should address this.
Verify Mealie instances and their exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mealie?

Mealie is a self-hosted recipe management software used to store, organize, and share cooking recipes. It is typically deployed by individuals or families to manage their personal kitchen data in a centralized, private web-based environment.

What does CWE-79 mean for CVE-2025-56795?

CWE-79 refers to Improper Neutralization of Input During Web Page Generation, commonly known as Stored Cross-Site Scripting (XSS). In this CVE, it means the software accepts malicious scripts in recipe fields and stores them permanently, causing the browser to execute that code whenever another user views the recipe.

How is this vulnerability triggered?

An attacker must have authenticated access to the application to inject malicious scripts into specific recipe note or text fields. Merely visiting the site or viewing public pages without submitting a recipe does not trigger the flaw, as the injection requires interacting with the recipe creation API.

Is my Mealie instance at risk?

According to Halo Surface Signal, risk depends on how you host your instance. While often used on private home networks, instances exposed to the internet are at higher risk because they are reachable by unauthorized parties who might attempt to authenticate and exploit the creation API.

What should I do if I run Mealie?

Identify all active instances of Mealie in your environment and check their version. If you are running version 3.0.1 or earlier, plan to update the software. Additionally, restrict access to your instance to trusted users only and review its exposure to ensure it is not unnecessarily accessible from the public internet.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.