EUVD-2026-16311Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionGitHub Advisory
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the FDC (USDA FoodData Central) search endpoint constructs an upstream API URL by directly interpolating the user-supplied query parameter into the URL string without URL-encoding. An attacker can inject additional URL parameters by including & characters in the query value. This allows overriding the API key, manipulating upstream query behavior, and causing server crashes (HTTP 500) via malformed requests - a Denial of Service condition. Version 2.6.0 patches the issue.
AnalysisAI
Tandoor Recipes versions prior to 2.6.0 allow authenticated remote attackers to cause denial of service by injecting URL parameters into the USDA FoodData Central search endpoint through improper URL encoding of the query parameter, enabling API key override and server crashes via malformed requests. Publicly available exploit code exists, and a vendor-released patch is available in version 2.6.0.
Technical ContextAI
Tandoor Recipes is a recipe management and meal planning application (CPE: cpe:2.3:a:tandoorrecipes:recipes) that integrates with the USDA FoodData Central (FDC) API for nutritional data lookup. The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), specifically URL parameter injection. The application constructs upstream API URLs by directly string interpolation of the user-supplied query parameter without URL-encoding. An attacker can inject additional URL parameters by including ampersand characters ('&') in the query value, allowing manipulation of API request behavior. This is a classic output encoding failure where user input is passed to a downstream HTTP client without sanitization, enabling parameter pollution attacks against the external FDC API endpoint.
RemediationAI
Upgrade Tandoor Recipes to version 2.6.0 or later immediately, as the vendor has released a patched version addressing the URL encoding issue. Until upgrade is feasible, administrators should restrict network access to the recipe search functionality to trusted users only, disable the FDC search feature if not required, and monitor application logs for HTTP 500 errors that may indicate exploitation attempts. Ensure that the application is running with the principle of least privilege and audit user accounts with access to recipe management features.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Tandoor Recipes prior to 2.5.1 contains a blind server-side request forgery vulnerability in the Cookmate recipe import
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. Rated medium severity (CVS
Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. Rated medium severity (CVSS 6.5), t
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” fu
Path traversal in Tandoor Recipes prior to 2.5.1 allows authenticated users with import permissions to read arbitrary fi
Privilege escalation in Tandoor Recipes prior to version 2.6.4 allows authenticated users with read-only shared access t
Authenticated users can modify and expose private recipes in Tandoor Recipes through broken object-level authorization i
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Ke
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard funct
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functiona
Unauthenticated API input validation flaws in Tandoor Recipes (<2.6.4) enable cross-tenant data leakage and denial of se
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today