CVE-2026-27627highCWE-79

CVE-2026-27627: high-severity vulnerability in karakeep-app karakeep

Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS

Published

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.4%
exploitation probability
0.4%top 68% of all CVEs
observed exploitation
nono source reports it
Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns `readableContentHtml`, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify, but the Reddit path skips both. Since this content ends up in `dangerouslySetInnerHTML` in the reader view, any malicious HTML in the Reddit response gets executed in the user's browser. Version 0.31.0 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected products
karakeep-app · karakeep
Related CVEs — karakeep-app karakeep

In the same product, most dangerous first.

CVE-2026-75773MEDIUMkarakeep-app karakeep Login Endpoint auth.ts authorize excessive authenticationEPSS 0.7%CVE-2026-75774MEDIUMkarakeep-app karakeep OAuth Sign-In auth.ts improper authenticationEPSS 0.6%CVE-2026-45082HIGHKarakeep has a SSRF Protection Bypass via Redirect HandlingEPSS 0.4%
References
https://github.com/karakeep-app/karakeep/commit/ba3db953c0d8675e2e3ecc29113a332b570b2cb9https://github.com/karakeep-app/karakeep/releases/tag/v0.31.0https://github.com/karakeep-app/karakeep/security/advisories/GHSA-mg93-f9mw-wpgj