PT-2026-28469 · Unknown · Tandoor Recipes

Liyander · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-33148

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.0

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions prior to 2.6.0 have an issue in the FDC (USDA FoodData Central) search endpoint where the query parameter is directly interpolated into the upstream API URL without URL-encoding. This allows an attacker to inject additional URL parameters using & characters within the query value. This can lead to overriding the API key, manipulating upstream query behavior, and causing server crashes (HTTP 500), resulting in a Denial of Service condition. The API endpoint vulnerable is the FDC search endpoint.

Recommendations Update to version 2.6.0 or later.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2026-33148

GHSA-43P3-WX6H-9G7W

Produtos afetados

Tandoor Recipes

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33148.json · Exploit
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-43p3-wx6h-9g7w · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037280588307247243 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33148 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33148 · Aviso do Fabricante