CVE-2026-27627

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27627
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27627.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27627
Aliases
  • GHSA-mg93-f9mw-wpgj
Published
2026-02-25T03:48:07.431Z
Modified
2026-03-01T07:34:20.898747Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS
Details

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns readableContentHtml, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify, but the Reddit path skips both. Since this content ends up in dangerouslySetInnerHTML in the reader view, any malicious HTML in the Reddit response gets executed in the user's browser. Version 0.31.0 contains a patch for this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27627.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/karakeep-app/karakeep

Affected ranges

Type
GIT
Repo
https://github.com/karakeep-app/karakeep
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ba3db953c0d8675e2e3ecc29113a332b570b2cb9

Affected versions

android/v1.*
android/v1.6.0
android/v1.6.0-1
android/v1.6.1-0
android/v1.6.1-1
android/v1.6.1-2
android/v1.6.1-3
android/v1.6.2-0
android/v1.6.2-1
android/v1.6.3-0
android/v1.6.4-0
android/v1.6.5-0
android/v1.6.6-0
android/v1.6.7-0
android/v1.6.7-1
android/v1.6.7-2
android/v1.6.7-3
android/v1.6.7-4
android/v1.6.8-0
android/v1.6.9-1
android/v1.7.0-0
android/v1.8.0-1
android/v1.8.1-0
android/v1.8.2-0
android/v1.8.2-1
android/v1.8.2-2
android/v1.8.3-0
android/v1.8.4-0
android/v1.8.5-0
cli/v0.*
cli/v0.13.0
cli/v0.13.2
cli/v0.13.3
cli/v0.13.5
cli/v0.13.6
cli/v0.13.7
cli/v0.20.0
cli/v0.23.0
cli/v0.25.0
cli/v0.27.0
cli/v0.27.1
cli/v0.29.0
cli/v0.29.1
cli/v0.30.0
extension/v1.*
extension/v1.2.1
extension/v1.2.2
extension/v1.2.3
extension/v1.2.4
extension/v1.2.5
extension/v1.2.6
extension/v1.2.7
extension/v1.2.8
ios/v1.*
ios/v1.6.0
ios/v1.6.0-1
ios/v1.6.1-0
ios/v1.6.1-1
ios/v1.6.1-2
ios/v1.6.1-3
ios/v1.6.2-0
ios/v1.6.2-1
ios/v1.6.3-0
ios/v1.6.4-0
ios/v1.6.5-0
ios/v1.6.7-0
ios/v1.6.7-1
ios/v1.6.7-2
ios/v1.6.7-3
ios/v1.6.7-4
ios/v1.6.8-0
ios/v1.6.9-0
ios/v1.6.9-1
ios/v1.7.0-0
ios/v1.8.0-1
ios/v1.8.1-0
ios/v1.8.2-0
ios/v1.8.3-0
ios/v1.8.4-0
mcp/v0.*
mcp/v0.23.10
mcp/v0.23.4
mcp/v0.23.5
mcp/v0.23.6
mcp/v0.23.7
mcp/v0.23.8
mcp/v0.23.9
mcp/v0.25.0
mcp/v0.26.0
mcp/v0.29.0
mobile-v1.*
mobile-v1.4.0
mobile-v1.5.0
sdk/v0.*
sdk/v0.21.0
sdk/v0.21.1
sdk/v0.21.2
sdk/v0.22.0
sdk/v0.23.0
sdk/v0.23.2
sdk/v0.26.0
sdk/v0.27.0
sdk/v0.29.0
sdk/v0.30.0
v.*
v.0.3.1
v.0.4.0
v0.*
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.12.2
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.17.1
v0.18.0
v0.19.0
v0.2.0
v0.2.1
v0.2.2
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.23.1
v0.23.2
v0.24.0
v0.24.1
v0.25.0
v0.26.0
v0.27.0
v0.27.1
v0.28.0
v0.29.0
v0.3.0
v0.30.0
v0.4.1
v0.5.0
v0.6.0
v0.7.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27627.json"