Skip to content
OpenAdvisories
High · 8.2 CVE-2026-27627 EUVD-2026-8614

Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS

Published Feb 25, 2026 · Updated Feb 25, 2026 · Assigned by GitHub_M

Description

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns `readableContentHtml`, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify, but the Reddit path skips both. Since this content ends up in `dangerouslySetInnerHTML` in the reader view, any malicious HTML in the Reddit response gets executed in the user's browser. Version 0.31.0 contains a patch for this issue.

Affected products

VendorProductAffectedFixed
karakeep-app karakeep = 0.30.0 —

References