Published: October 16, 2026 | Last Modified: October 16, 2026
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.