CVE-2026-35046

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary <style> tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the <style> tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. This vulnerability is fixed in 2.6.4.

• CWE-79

• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4Release Notes
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9hhh-g2fc-r8x2Exploit, Vendor Advisory
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9hhh-g2fc-r8x2Exploit, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35040fast-jwt provides fast JSON Web Token (JWT) implementation. …5.3
• CVE-2026-35041fast-jwt provides fast JSON Web Token (JWT) implementation. …6.5
• CVE-2026-35042fast-jwt provides fast JSON Web Token (JWT) implementation. …7.5
• CVE-2026-35043BentoML is a Python library for building online serving syst…7.8
• CVE-2026-35044BentoML is a Python library for building online serving syst…9.6
• CVE-2026-35045Tandoor Recipes is an application for managing recipes, plan…8.1
• CVE-2026-35047Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestri…9.8
• CVE-2026-35048The Piwigo installer in versions 16.3.0 and earlier accepts …9.8
• CVE-2026-35049wire-ios is an iOS client for the Wire secure messaging appl…6.5
• CVE-2026-3505Allocation of resources without limits or throttling, Uncont…8.7
• CVE-2026-35050text-generation-webui is an open-source web interface for ru…8.8
• CVE-2026-35051Traefik is an HTTP reverse proxy and load balancer. Prior to…10