Nixpkgs security tracker

Untriaged

Permalink CVE-2026-27627

8.2 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): LOW
Availability impact (A): NONE

created 1 month, 4 weeks ago Activity log

Created suggestion 1 month, 4 weeks ago

Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns `readableContentHtml`, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify, but the Reddit path skips both. Since this content ends up in `dangerouslySetInnerHTML` in the reader view, any malicious HTML in the Reddit response gets executed in the user's browser. Version 0.31.0 contains a patch for this issue.

References

https://github.com/karakeep-app/karakeep/security/advisories/GHSA-mg93-f9mw-wpgj x_refsource_CONFIRM
https://github.com/karakeep-app/karakeep/commit/ba3db953c0d8675e2e3ecc29113a332b570b2cb9 x_refsource_MISC
https://github.com/karakeep-app/karakeep/releases/tag/v0.31.0 x_refsource_MISC

Affected products

karakeep

=== 0.30.0

Matching in nixpkgs

pkgs.karakeep

Self-hostable bookmark-everything app (links, notes and images) with AI-based automatic tagging and full text search

nixos-unstable 0.30.0
- nixpkgs-unstable 0.30.0
- nixos-unstable-small 0.30.0
nixos-25.11 0.29.3
- nixos-25.11-small 0.29.3
- nixpkgs-25.11-darwin 0.29.3

Package maintainers

@three Eric Roberts <eric@ericroberts.dev>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.karakeep

Package maintainers