CVE-2026-42451
Stored XSS in Grimmory EPUB Reader
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| grimmory | grimmory | to 2.3.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue in Grimmory's browser-based EPUB reader prior to version 2.3.1. An attacker can embed arbitrary JavaScript code inside a specially crafted EPUB file. When a user opens this malicious EPUB file in Grimmory, the embedded script executes within the user's browser with full access to the Grimmory application's session context.
How can this vulnerability impact me? :
The vulnerability can lead to session token theft and account takeover. If an attacker tricks a user into opening the crafted EPUB file, the attacker can execute malicious scripts that steal the user's session tokens. This can result in unauthorized access to the user's account, including administrative access if an administrator opens the affected book.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Grimmory to version 2.3.1 or later, where the stored cross-site scripting (XSS) issue in the browser-based EPUB reader has been patched.
Avoid opening EPUB files from untrusted sources until the update is applied, especially if you have administrative access.