PT-2026-30685 · Unknown · Tandoor Recipes

Filipegaudard · CVE-2026-35046 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.4

Description Tandoor Recipes allows authenticated users to inject arbitrary tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the tag, allowing unsanitized CSS payloads to be persisted and served via the API. Clients consuming instructions markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS, potentially enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration.

Recommendations Update to version 2.6.4 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35046

GHSA-9HHH-G2FC-R8X2

Affected Products

Tandoor Recipes

References · 6

• 🔥 https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9hhh-g2fc-r8x2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35046.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35046 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35046 · Vendor Advisory
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 · Note
• https://twitter.com/CVEnew/status/2041223958083571871 · Twitter Post