Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Attack is delivered via HTTP upload (AV:N); PR:L reflects required account; S:C because script executes in victim's browser origin context; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in Grimmory's browser-based EPUB reader allows an attacker to embed arbitrary JavaScript in a crafted EPUB file. When a victim opens the book, the script executes in their browser with full access to the Grimmory application's session context. This can enable session token theft and account takeover, including administrative access if an administrator opens the affected book. This issue has been patched in version 2.3.1.
AnalysisAI
Stored XSS in Grimmory's browser-based EPUB reader (versions prior to 2.3.1) allows a low-privileged attacker who can add books to the library to embed arbitrary JavaScript in a crafted EPUB file, which executes in any opening user's browser with full access to the Grimmory session context. If an administrator opens the malicious book, the attacker can steal the admin session token and achieve full account takeover. No public exploit has been identified (EPSS 0.01%, 1st percentile), and vendor-released patch v2.3.1 is available.
Technical ContextAI
Grimmory is a self-hosted digital library web application (CPE: cpe:2.3:a:grimmory-tools:grimmory) that renders EPUB content through a browser-based reader built on the Foliate viewer library. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) is that the Foliate component was configured with the allow-scripts permission, permitting JavaScript embedded in EPUB content to execute in the host browser's document context. Because the reader runs within the Grimmory web application's origin, malicious scripts inherit the application's session cookies and local storage, enabling cross-session attacks. The fix in v2.3.1 removed the allow-scripts attribute from the Foliate reader and applied a Content Security Policy (CSP) scoped to EPUB resources, blocking inline script execution at the browser level.
RemediationAI
Upgrade Grimmory to version 2.3.1, released 2026-04-22, which removes the allow-scripts permission from the Foliate EPUB reader and enforces a Content Security Policy for EPUB resources (commit 5448205). The release is available at https://github.com/grimmory-tools/grimmory/releases/tag/v2.3.1. If an immediate upgrade is not possible, the most effective compensating control is restricting book-upload permissions to fully trusted accounts only, reducing the pool of potential attackers; note this does not eliminate risk if any trusted account is compromised. Disabling the browser-based EPUB reader entirely and directing users to download books for offline reading is a more aggressive workaround that eliminates the attack surface at the cost of in-browser reading functionality.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today