PT-2026-21852 · Reddit+1 · Reddit Metascraper Plugin+1

Byamb4 · Publicado 2026-02-25 · Atualizado 2026-03-10 · CVE-2026-27627

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Karakeep version 0.30.0

Description Karakeep is an elf-hostable bookmark-everything app. Version 0.30.0 does not properly sanitize HTML content received from the Reddit metascraper plugin. Specifically, when the plugin returns readableContentHtml, the application directly uses this content in the HTML parsing subprocess without running it through DOMPurify. This unsanitized content is then injected into the application’s Document Object Model (DOM) via React’s dangerouslySetInnerHTML, potentially allowing malicious HTML to be executed in a user’s browser.

Recommendations Update to version 0.31.0 to address this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27627

GHSA-MG93-F9MW-WPGJ

Produtos afetados

Karakeep

Reddit Metascraper Plugin

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27627.json · Exploit
• https://github.com/karakeep-app/karakeep/releases/tag/v0.31.0 · Nota
• https://github.com/karakeep-app/karakeep/security/advisories/GHSA-mg93-f9mw-wpgj · Aviso do Fabricante
• https://github.com/karakeep-app/karakeep/commit/ba3db953c0d8675e2e3ecc29113a332b570b2cb9 · Correção
• https://t.me/CVEtracker/45678 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2026553181061161196 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026641351178059890 · Publicação no Twitter
• https://twitter.com/CveTodo/status/2026515005508665438 · Publicação no Twitter
• https://t.me/cveNotify/154959 · Publicação no Telegram
• https://t.me/cveNotify/153560 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27627 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27627 · Nota de Segurança
• https://twitter.com/cracbot/status/2028425202959593962 · Publicação no Twitter
• https://t.me/cveNotify/153096 · Publicação no Telegram