CVE-2026-59966
MEDIUM 5.7Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 25th percentile
Impact if exploited
5.7CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-1333: : Inefficient Regular Expression Complexity
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.7 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - MEDIUM 5.7 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7 CVE record · GitHub_M · Updated 2026-10-16T19:18:57.453Z
CVE record · CISA-ADP · Updated 2026-10-16T19:40:13.402Z
NVD · CVE-2026-59966 · Updated 2026-10-19T20:52:47.340
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103143 EUVD · EUVD-2026-103143
Technical & other
- https://github.com/TandoorRecipes/recipes/commit/adc2732712819d7fe26a9f74f6b0271c1a9d87c3 CVE record · GitHub_M · Updated 2026-10-16T19:18:57.453Z
NVD · CVE-2026-59966 · Updated 2026-10-19T20:52:47.340 - https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10 CVE record · GitHub_M · Updated 2026-10-16T19:18:57.453Z
NVD · CVE-2026-59966 · Updated 2026-10-19T20:52:47.340