Koodo Reader CVE-2026-55408

Exploitation requires the victim to import and then open an attacker-crafted EPUB file inside Koodo Reader 2.3.0 or earlier; the specific enabling conditions are the open-book IPC handler running with nodeIntegrationInSubFrames enabled and EPUB chapter content being rendered through unsanitized innerHTML, which together let book-supplied markup reach Node.js APIs. Limiting factors: this is not remote/network exploitation - the CVSS vector is AV:L with UI:A, so the attacker must first deliver the malicious book to the target and the target must actively load it; there is no application-side privilege requirement (PR:N), but the resulting commands run only with the victim user's existing OS privileges. It affects default configurations of the vulnerable desktop builds - the victim needs no non-default setting - and no additional authentication is involved.

The provided CVSS 4.0 score is 8.4 (High) with vector AV:L/AC:L/AT:N/PR:N/UI:A and full VC/VI/VA:H - meaning complete compromise of the local system but gated behind local delivery and required user interaction (importing and opening a crafted book). The impact is genuinely severe, yet this is not a mass-exploitable network flaw: AV:L and UI:A mean the victim must be socially engineered into loading an attacker's EPUB, which favors targeted rather than opportunistic exploitation. No EPSS score, KEV entry, POC, or SSVC decision was provided, so exploitation status remains 'no public exploit identified at time of analysis' and should not be inflated to 'in the wild.' The signals are internally consistent - the description (needs a malicious file to be opened) does not conflict with the CVSS vector (local, user interaction). Net priority is moderate-to-high for organizations that actually run Koodo Reader and whose users import untrusted ebooks, and low for everyone else.

An attacker crafts an EPUB whose chapter HTML embeds JavaScript that, when rendered via innerHTML inside the Node-enabled iframe, invokes Node's child_process to run OS commands. They distribute it as a free book download, email attachment, or shared library file; when the victim imports and opens it in a vulnerable Koodo Reader, the payload silently executes with the victim's privileges. No public POC is currently identified, but the attack requires only local delivery (AV:L) and a single user action (UI:A) at low complexity.