CVE-2022-23074 Recipes - Stored XSS in Name Parameter
A low-privileged attacker can inject stored XSS payloads into recipe fields, allowing them to steal API keys and take over admin accounts when victims view the content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-23074?
CVE-2022-23074 is a low-severity cross-site scripting vulnerability in recipes, published on 21 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
Weakness: CWE-79
Which versions are affected by CVE-2022-23074?
It affects 1 product.
Products include Tandoor Recipes.
How do I fix CVE-2022-23074?
No fix has been published for CVE-2022-23074 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-23074 being exploited?
There is no known exploitation of CVE-2022-23074 in the wild and no public exploit code.
Other vulnerabilities in recipes
- CVE-2025-23211 Tandoor Recipes - SSTI - Remote Code Execution
- CVE-2026-33152 Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication
- CVE-2025-23213 Tandoor Recipes - Stored XSS through Unrestricted File Upload
- CVE-2026-35488 Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users
- CVE-2026-35045 Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification
Sources
Also known as GHSA-f78f-957j-7jxh.