Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2025-70296
5.4
MEDIUMCVSS v3
Published
February 11, 2026
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view.
Docker Hub
mealie-recipes/mealie
GitHubMealie is a self hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in Vue for a pleasant user experience for the whole family. Easily add recipes into your database by providing the url and mealie will automatically import the relevant data or add a family recipe with the UI editor
GitHubMealie is a self hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in Vue for a pleasant user experience for the whole family. Easily add recipes into your database by providing the url and mealie will automatically import the relevant data or add a family recipe with the UI editor>= 3.3.1, < 3.8.0NVD