What is the CVSS score of CVE-2026-33148?

CVE-2026-33148 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Recipes are affected by CVE-2026-33148?

Organizations using versions should be aware of notable risk from CVE-2026-33148, a injection vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-33148?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Recipes CVE-2026-33148

EUVD-2026-16311 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-26 GitHub_M

Denial Of Service Recipes

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.6.0

EUVD ID Assigned

Mar 26, 2026 - 19:16 euvd

EUVD-2026-16311

Analysis Generated

Mar 26, 2026 - 19:16 vuln.today

CVE Published

Mar 26, 2026 - 19:04 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the FDC (USDA FoodData Central) search endpoint constructs an upstream API URL by directly interpolating the user-supplied query parameter into the URL string without URL-encoding. An attacker can inject additional URL parameters by including & characters in the query value. This allows overriding the API key, manipulating upstream query behavior, and causing server crashes (HTTP 500) via malformed requests - a Denial of Service condition. Version 2.6.0 patches the issue.

AnalysisAI

Tandoor Recipes versions prior to 2.6.0 allow authenticated remote attackers to cause denial of service by injecting URL parameters into the USDA FoodData Central search endpoint through improper URL encoding of the query parameter, enabling API key override and server crashes via malformed requests. Publicly available exploit code exists, and a vendor-released patch is available in version 2.6.0.

Technical ContextAI

Tandoor Recipes is a recipe management and meal planning application (CPE: cpe:2.3:a:tandoorrecipes:recipes) that integrates with the USDA FoodData Central (FDC) API for nutritional data lookup. The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), specifically URL parameter injection. The application constructs upstream API URLs by directly string interpolation of the user-supplied query parameter without URL-encoding. An attacker can inject additional URL parameters by including ampersand characters ('&') in the query value, allowing manipulation of API request behavior. This is a classic output encoding failure where user input is passed to a downstream HTTP client without sanitization, enabling parameter pollution attacks against the external FDC API endpoint.

RemediationAI

Upgrade Tandoor Recipes to version 2.6.0 or later immediately, as the vendor has released a patched version addressing the URL encoding issue. Until upgrade is feasible, administrators should restrict network access to the recipe search functionality to trusted users only, disable the FDC search feature if not required, and monitor application logs for HTTP 500 errors that may indicate exploitation attempts. Ensure that the application is running with the principle of least privilege and audit user accounts with access to recipe management features.