A critical Cross-Site Scripting vulnerability in Karakeep version 0.30.0 allows unauthenticated attackers to execute malicious scripts in a user's browser via the Reddit metascraper plugin.

The application fails to sanitize readableContentHtml returned by the Reddit metascraper, bypassing DOMPurify and allowing malicious HTML to be rendered via dangerouslySetInnerHTML. This enables unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks by injecting scripts that execute within the context of a victim's browser session.

Successful exploitation poses a significant risk to user data and session integrity. An attacker can hijack user sessions, steal sensitive credentials, or perform unauthorized actions on behalf of the user within the Karakeep application. Given the CVSS score of 8.2, this vulnerability represents a high-severity risk that could lead to widespread account compromise if not addressed.

Immediate Action: Update the Karakeep application to version 0.31.0 or later to implement the required security sanitization.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the Reddit integration endpoints and monitor for suspicious browser-side activity.

Compensating Controls: Deploy a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious payloads in incoming traffic.

Public Exploit Available: No — there is no confirmed public weaponized exploit or published Proof-of-Concept at this time.

The severity of this vulnerability necessitates immediate action to prevent potential session hijacking and data theft. Administrators should prioritize upgrading to version 0.31.0 immediately, as this update specifically addresses the sanitization failure that enables the XSS attack. Failure to patch this vulnerability leaves users exposed to potential malicious script execution within their authenticated sessions.