PT-2026-28469 · Unknown · Tandoor Recipes

Liyander · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33148

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.0

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions prior to 2.6.0 have an issue in the FDC (USDA FoodData Central) search endpoint where the query parameter is directly interpolated into the upstream API URL without URL-encoding. This allows an attacker to inject additional URL parameters using & characters within the query value. This can lead to overriding the API key, manipulating upstream query behavior, and causing server crashes (HTTP 500), resulting in a Denial of Service condition. The API endpoint vulnerable is the FDC search endpoint.

Recommendations Update to version 2.6.0 or later.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-33148

GHSA-43P3-WX6H-9G7W

Affected Products

Tandoor Recipes

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33148.json · Exploit
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-43p3-wx6h-9g7w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33148 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33148 · Vendor Advisory
• https://twitter.com/CVEnew/status/2037280588307247243 · Twitter Post