CVE-2025-70296
📋 TL;DR
A stored HTML injection vulnerability in Mealie 3.3.1 allows authenticated users to inject arbitrary HTML into recipe notes, which can lead to user interface redressing attacks. This affects all users of Mealie 3.3.1 who view recipes with malicious notes. The vulnerability requires authenticated access but can impact any user viewing compromised recipes.
💻 Affected Systems
- Mealie
📦 What is this software?
Mealie by Mealie
⚠️ Risk & Real-World Impact
Worst Case
An attacker could inject malicious HTML/JavaScript that performs phishing attacks, steals session cookies, or redirects users to malicious sites when viewing recipes.
Likely Case
Authenticated users inject HTML that alters the recipe interface appearance, potentially tricking users into unintended actions or displaying misleading content.
If Mitigated
With proper input validation and output encoding, injected HTML would be rendered as plain text without executing.
🎯 Exploit Status
Exploitation requires authenticated access and user interaction (viewing the malicious recipe). The vulnerability is in HTML rendering without proper sanitization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in pull request #6743 (commit after 3.3.1)
Vendor Advisory: https://github.com/mealie-recipes/mealie/issues/6690
Restart Required: No
Instructions:
1. Update Mealie to the latest version containing the fix from pull request #6743. 2. Verify the Recipe Notes component properly sanitizes HTML input. 3. No service restart required for the patch itself.
🔧 Temporary Workarounds
Disable Recipe Notes Editing
allTemporarily disable the Recipe Notes editing functionality for all users to prevent HTML injection.
Modify Mealie configuration to remove or disable the recipe notes input field in the UI.
Input Validation Filter
allImplement server-side input validation to strip or escape HTML tags in recipe notes before storage.
Add HTML sanitization to the recipe notes processing function before saving to database.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent execution of injected scripts.
- Monitor recipe notes for suspicious HTML patterns and alert on potential injection attempts.
🔍 How to Verify
Check if Vulnerable:
Test by creating a recipe note with HTML tags like <script>alert('test')</script> or <img src=x onerror=alert(1)> and check if they execute when viewing the recipe.Check Version:
Check Mealie version in the application interface or via the application's version endpoint if available.Verify Fix Applied:
After patching, attempt the same HTML injection test - HTML should be displayed as plain text without execution.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML patterns in recipe notes creation/update logs
- Multiple rapid recipe note modifications from single user
Network Indicators:
- Increased traffic to recipe viewing endpoints with unusual parameters
SIEM Query:
search 'recipe_note' AND ('<script>' OR '<img' OR 'onerror=') in application logs