CVE-2025-56795
📋 TL;DR
CVE-2025-56795 is a stored cross-site scripting vulnerability in Mealie recipe management software. Attackers can inject malicious scripts into recipe notes and text fields that execute when other users view those recipes. All users of Mealie 3.0.1 and earlier are affected.
💻 Affected Systems
- Mealie
📦 What is this software?
Mealie by Mealie
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, and unauthorized actions performed in the context of authenticated users.
If Mitigated
With proper input validation and output encoding, no script execution occurs and user input is safely displayed.
🎯 Exploit Status
Exploitation requires authenticated access to create or edit recipes. Public proof-of-concept demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.2 or later
Vendor Advisory: https://github.com/mealie-recipes/mealie/issues/5677
Restart Required: Yes
Instructions:
1. Update Mealie to version 3.0.2 or later. 2. Restart the Mealie service. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize HTML/JavaScript content in recipe notes and text fields
Content Security Policy
allImplement strict Content Security Policy headers to prevent script execution from untrusted sources
🧯 If You Can't Patch
- Disable recipe creation/editing functionality for non-admin users
- Implement a web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check if Mealie version is 3.0.1 or earlier. Test by creating a recipe with <script>alert('XSS')</script> in note/text field and viewing it.Check Version:
Check Mealie web interface settings or docker container version: docker inspect mealie | grep versionVerify Fix Applied:
After updating to 3.0.2+, test XSS payloads in recipe fields - they should be properly escaped and not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /api/recipes/ with script tags or JavaScript in parameters
- Multiple failed XSS attempts in web logs
Network Indicators:
- HTTP requests containing script tags or JavaScript in recipe API calls
- Unusual outbound connections from Mealie server after recipe views
SIEM Query:
source="mealie-logs" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=") AND uri_path="/api/recipes/*"