CVE-2025-70296

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-70296

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-70296.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-70296

Published

2026-02-11T00:00:00Z

Modified

2026-07-15T01:49:11.715898374Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70296.json"
}

References

Affected packages

Git / github.com/mealie-recipes/mealie

Affected ranges

Type

GIT

Repo

https://github.com/mealie-recipes/mealie

Events

Introduced

c63932e8b3aea975332713551de2cadd9bafaba9

Fixed

a6fc98fc82b2b12037619286a5470377d837571b

Database specific

{
    "cpe": "cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.3.1"
        },
        {
            "fixed": "3.8.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v3.*

v3.3.1

v3.3.2

v3.4.0

v3.5.0

v3.6.0

v3.6.1

v3.7.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-70296.json"