{"id":"CVE-2026-59966","kind":"vulnerability","aliases":["CVE-2026-59966"],"related":[],"title":"Tandoor Recipes: regex automation lets one user stall recipe imports","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.","summary":"Tandoor Recipes runs user-supplied Automation regex patterns through Python re.sub() with no complexity check or timeout. A logged-in user who stores a catastrophic-backtracking pattern can make a shared-Space member's recipe import hang and tie up Gunicorn workers, taking the service down for others.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","python","self-hosted","tandoor-recipes"],"not_affected_if":["default-config","single-user-instance"],"how_to_check":"- Check the installed Tandoor version; the sources say the fix is in 2.6.10 and earlier versions are affected.\n- Review Automation entries in shared Spaces for unusually complex regex patterns.","fix":"- Upgrade Tandoor Recipes to `2.6.10` or later.","status":"open","published_at":"2026-10-16T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:10:28+00:00","updated_at":"2026-10-25T04:10:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Tandoor Recipes to `2.6.10` or later.","reach":"internet","title":"Tandoor Recipes: regex automation lets one user stall recipe imports","impact":"medium","summary":"Tandoor Recipes runs user-supplied Automation regex patterns through Python re.sub() with no complexity check or timeout. A logged-in user who stores a catastrophic-backtracking pattern can make a shared-Space member's recipe import hang and tie up Gunicorn workers, taking the service down for others.","category":"package","nicknames":[],"who_cares":["tandoor-recipes","self-hosted","python"],"confidence":0.6,"needs_auth":"yes","worst_case":"Service becomes unavailable as worker slots are exhausted","analyst_note":"","how_to_check":"- Check the installed Tandoor version; the sources say the fix is in 2.6.10 and earlier versions are affected.\n- Review Automation entries in shared Spaces for unusually complex regex patterns.","needs_analyst":false,"not_affected_if":["single-user-instance","default-config"],"who_is_affected":"Self-hosted Tandoor instances running versions before 2.6.10 where users share a Space and can create Automations. Exposure needs a user with an account in the same Space who stores a malicious pattern and another user who imports a matching recipe. Single-user instances or those without shared Spaces face less risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000609,"input_tokens":3462,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-59966':13A,16A '2':138C '2.6.10':93C,191C 'api/recipe-from-source':144C 'appli':139C 'applic':81C,175C 'attack':146C 'authent':115C 'autom':4A,31B,98C,142C,153C 'automation.param':137C 'backtrack':53B,121C 'build':88C 'catastroph':52B,120C 'catastrophic-backtrack':51B,119C 'check':40B 'complex':39B,107C 'control':97C 'cve':11A,14A 'engin':154C 'evalu':155C 'execut':94C,111C 'exhaust':174C 'express':101C 'fix':188C 'gunicorn':69B,166C 'hang':65B 'host':21B 'import':10A,64B,130C,161C 'issu':186C 'let':5A 'list':90C 'log':45B 'logged-in':44B 'make':56B,179C 'malici':157C 'manag':83C 'match':132C 'meal':86C 'member':61B 'occupi':164C 'one':6A 'other':76B 'packag':17B 'pattern':33B,54B,102C,158C 'plan':85C 'prior':91C 'process':135C 'python':18B,35B,104C 're.sub':36B,105C 'recip':2A,9A,24B,26B,63B,78C,84C,133C,160C 'regex':3A,32B,122C,140C 'regular':100C 'regular-express':99C 'replac':141C 'request':134C,170C 'run':27B 'self':20B 'self-host':19B 'servic':73B,181C 'share':59B,151C 'shared-spac':58B,150C 'shop':89C 'slot':177C 'space':60B,129C,152C 'stall':8A 'store':49B,117C 'sub':143C 'suppli':30B 'take':71B 'tandoor':1A,23B,25B,77C 'tandoor-recip':22B 'tie':67B 'timeout':42B,112C,171C 'unavail':182C 'use':136C 'user':7A,29B,47B,96C,116C,125C,184C 'user-control':95C 'user-suppli':28B 'valid':108C 'version':190C 'without':106C 'work':147C 'worker':70B,167C,176C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Tandoor instances running versions before 2.6.10 where users share a Space and can create Automations. Exposure needs a user with an account in the same Space who stores a malicious pattern and another user who imports a matching recipe. Single-user instances or those without shared Spaces face less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59966","severity":null,"published_at":"2026-10-16T20:17:23+00:00","modified_at":"2026-10-19T20:52:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}