CVE-2025-56795

PoC ×2—

CVSS 3.1

9.0 critical

EPSS

<1%p30

Published

Sep 29, 2025 (Sep 29, 2025)

Modified

Jun 17, 2026

Description

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/{recipe_name}" endpoint is rendered in the frontend without proper escaping leading to persistent XSS.

Vendors: mealie
Products: mealie
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.