CVE-2026-27627

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns `readableContentHtml`, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify, but the Reddit path skips both. Since this content ends up in `dangerouslySetInnerHTML` in the reader view, any malicious HTML in the Reddit response gets executed in the user's browser. Version 0.31.0 contains a patch for this issue.

• CWE-79

• https://github.com/karakeep-app/karakeep/commit/ba3db953c0d8675e2e3ecc29113a332b570b2cb9Patch
• https://github.com/karakeep-app/karakeep/releases/tag/v0.31.0Product, Release Notes
• https://github.com/karakeep-app/karakeep/security/advisories/GHSA-mg93-f9mw-wpgjExploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27621TypiCMS is a multilingual content management system based on…5.4
• CVE-2026-27622OpenEXR provides the specification and reference implementat…7.8
• CVE-2026-27623Valkey is a distributed key-value database. Starting in vers…7.5
• CVE-2026-27624Coturn is a free open source implementation of TURN and STUN…6.5
• CVE-2026-27625Stirling-PDF is a locally hosted web application that perfor…6.5
• CVE-2026-27626OliveTin gives access to predefined shell commands from a we…9.9
• CVE-2026-27628pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2026-27629InvenTree is an Open Source Inventory Management System. Pri…8.8
• CVE-2026-2763Use-after-free in the JavaScript Engine component. This vuln…9.8
• CVE-2026-27630TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
• CVE-2026-27631Exiv2 is a C++ library and a command-line utility to read, w…5.3
• CVE-2026-27632Talishar is a fan-made Flesh and Blood project. Prior to com…3.1