CVE-2026-42451
Received Received - Intake
Stored XSS in Grimmory EPUB Reader

Publication date: 2026-05-08

Last updated on: 2026-05-08

Assigner: GitHub, Inc.

Description
Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in Grimmory's browser-based EPUB reader allows an attacker to embed arbitrary JavaScript in a crafted EPUB file. When a victim opens the book, the script executes in their browser with full access to the Grimmory application's session context. This can enable session token theft and account takeover, including administrative access if an administrator opens the affected book. This issue has been patched in version 2.3.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-08
Last Modified
2026-05-08
Generated
2026-06-19
AI Q&A
2026-05-09
EPSS Evaluated
2026-06-18
NVD
CVE-2026-42451
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
grimmory grimmory to 2.3.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows an attacker to execute arbitrary JavaScript in the context of the Grimmory application, potentially leading to session token theft and account takeover, including administrative access.

Such unauthorized access and potential data breaches could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal data and secure access controls.

However, the specific effects on compliance depend on the nature of the data stored and processed by Grimmory and the organization's implementation of security controls.

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in Grimmory's browser-based EPUB reader prior to version 2.3.1. An attacker can embed arbitrary JavaScript code inside a specially crafted EPUB file. When a user opens this malicious EPUB file in Grimmory, the embedded script executes within the user's browser with full access to the Grimmory application's session context.

Impact Analysis

The vulnerability can lead to session token theft and account takeover. If an attacker tricks a user into opening the crafted EPUB file, the attacker can execute malicious scripts that steal the user's session tokens. This can result in unauthorized access to the user's account, including administrative access if an administrator opens the affected book.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Grimmory to version 2.3.1 or later, where the stored cross-site scripting (XSS) issue in the browser-based EPUB reader has been patched.

Avoid opening EPUB files from untrusted sources until the update is applied, especially if you have administrative access.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart