Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-27627 is a stored Cross-Site Scripting (XSS) vulnerability in the Karakeep application caused by the Reddit metascraper plugin bypassing the usual HTML sanitization process.'}, {'type': 'paragraph', 'content': "Specifically, when the Reddit plugin returns HTML content in the field `readableContentHtml` (derived from Reddit posts' `selftext_html`), this content is used directly without being sanitized by DOMPurify, unlike other content sources that go through Readability and DOMPurify sanitization."}, {'type': 'paragraph', 'content': "Because this unsanitized HTML is rendered in the browser using React's `dangerouslySetInnerHTML` without Content-Security-Policy protections, any malicious scripts embedded in the Reddit content execute in the user's browser."}, {'type': 'paragraph', 'content': "An attacker can exploit this by injecting malicious HTML or JavaScript into a Reddit post's content, which then gets stored in Karakeep's database and executes whenever the victim views the bookmark."}, {'type': 'paragraph', 'content': 'This vulnerability was fixed in Karakeep version 0.31.0 by introducing DOMPurify sanitization for the Reddit metascraper plugin output.'}] [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute stored Cross-Site Scripting (XSS) attacks within the Karakeep application context.

• Attackers can steal session cookies and JWT tokens, potentially hijacking user sessions.
• They can read all victim bookmarks, lists, and API keys stored in the application.
• Attackers may perform actions on behalf of the victim, such as creating or deleting bookmarks and changing user settings.
• If an administrator views a malicious bookmark, privilege escalation is possible.
• The malicious payload persists in the database and triggers every time the affected bookmark is opened in reader view.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves unsanitized HTML content from the Reddit metascraper plugin being stored and executed in the Karakeep application. Detection involves identifying if any bookmarks contain unsanitized Reddit content that could execute malicious scripts.'}, {'type': 'paragraph', 'content': 'One approach is to inspect the stored bookmark data for HTML content originating from Reddit posts, specifically looking for suspicious or unexpected script tags or event handlers such as onerror attributes within the `selftext_html` field.'}, {'type': 'paragraph', 'content': 'Since the vulnerability manifests as stored Cross-Site Scripting (XSS), you can search the database or exported bookmark data for suspicious HTML patterns.'}, {'type': 'list_item', 'content': "Use grep or similar tools to search for suspicious HTML in bookmark data files or database exports, e.g., `grep -i -r '<script' /path/to/bookmarks` or `grep -i -r 'onerror' /path/to/bookmarks`."}, {'type': 'list_item', 'content': "If you have access to the database, run queries to find bookmarks where the HTML content contains potentially dangerous tags or attributes, for example: `SELECT * FROM bookmarkLinks WHERE htmlContent LIKE '%<script%' OR htmlContent LIKE '%onerror=%';`"}, {'type': 'paragraph', 'content': 'Additionally, monitoring network traffic for suspicious requests triggered by malicious scripts (such as unexpected calls to external attacker domains) when users open bookmarks could help detect exploitation.'}] [3]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade the Karakeep application to version 0.31.0 or later, which includes a patch that sanitizes the Reddit metascraper plugin output using DOMPurify, preventing malicious HTML from being executed.

Until the upgrade is applied, avoid opening bookmarks sourced from Reddit posts that might contain unsanitized HTML content, as this could trigger the stored XSS.

If possible, review and sanitize existing stored bookmark data to remove malicious HTML content manually or via scripts that apply DOMPurify or similar sanitization.

Consider implementing Content-Security-Policy (CSP) headers in the application to restrict script execution and mitigate the impact of any injected scripts.

Monitor and audit user activity and logs for suspicious behavior that could indicate exploitation of this vulnerability.

Useful 0 Not Useful 0