Critical · published September 29, 2025
🚨 A tiny note could unleash chaos! Mealie 3.0.1 and earlier has a stored XSS vulnerability in recipe creation, turning innocent input into a playground for attackers! 🔥 Think of it like a restaurant that allows customers to write their own specials on the menu. If nobody checks those entries, a prankster could write in something ridiculous—like ‘baked spiders’—which could send unsuspecting diners home feeling quite unwell! With this vulnerability, an attacker could inject malicious scripts that run every time someone views the affected recipe. They could steal cookies, hijack user sessions, or even redirect users to phishing sites, putting users at serious risk. This is absolutely devastating for user trust and could lead to data breaches.
Think of it like a restaurant that allows customers to write their own specials on the menu. If nobody checks those entries, a prankster could write in something ridiculous—like ‘baked spiders’—which could send unsuspecting diners home feeling quite unwell! The stored XSS comes from unsanitized input in the 'note' and 'text' fields of the '/api/recipes/{recipe_name}' endpoint. When these fields are rendered on the frontend, they are not properly escaped, allowing attackers to execute their scripts persistently.
With this vulnerability, an attacker could inject malicious scripts that run every time someone views the affected recipe. They could steal cookies, hijack user sessions, or even redirect users to phishing sites, putting users at serious risk. This is absolutely devastating for user trust and could lead to data breaches. To secure your application, upgrade to Mealie version 3.0.2 or later immediately. Additionally, validate and sanitize all user input to prevent malicious scripts from being executed. Regularly review your code for proper escaping practices. You've got this! Patch up and protect your app like the security hero you are! 🛡️