CVE-2026-59966
mediumTandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/TandoorRecipes/recipes/commit/adc2732712819d7fe26a9f74f6b0271c1a9d87c3 security-advisories@github.com
- https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10 security-advisories@github.com
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7 security-advisories@github.com
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7 134c704f-9b21-4f2e-91b3-4a467353bcc0