# CVE-2026-35046: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…

Source: https://junglewise.ai/threats/cve-2026-35046-tandoor-recipes-is-an-application-for-managing-recipes-planning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06  
License: CC BY 4.0 with a link back

CVE-2026-35046 · Severity: medium · CVSS 5.4 · Published 2026-04-06

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary <style> tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the <style> tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. This vulnerability is fixed in 2.6.4.

Technologies: [Tandoor Recipes](https://junglewise.ai/threats/technologies/recipes). Vendors: [Tandoor](https://junglewise.ai/threats/vendors/tandoor).

## Quick answers

**Is CVE-2026-35046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35046 being exploited in the wild.

**How severe is CVE-2026-35046?** Medium severity, with a CVSS score of 5.4, published 6 April 2026.

**Which products and versions are affected?** Tandoor Recipes. The advisory does not name versions.

**Is there a fix for CVE-2026-35046?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-35046?** Check whether you run Tandoor Recipes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Tandoor Recipes

## Related threats

- [Tandoor Recipes unauthorized access to other members' bookmarklets](https://junglewise.ai/threats/cve-2026-59967-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes Denial of Service via ZIP Bomb in recipe import](https://junglewise.ai/threats/cve-2026-27460-tandoor-recipes-denial-of-service-via-zip-bomb-in-recipe-import)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35489-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35488-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35045-tandoor-recipes-is-an-application-for-managing-recipes-planning)