Karakeep
Monthly
Server-side request forgery in Karakeep self-hosted bookmark manager versions prior to 0.32.0 allows authenticated users to bypass internal-network protections by chaining attacker-controlled HTTP redirects, reaching Docker-internal services from the crawler and video download flows. Publicly available exploit code exists per SSVC, though EPSS is low at 0.03% and the issue is not in CISA KEV. Fixed in version 0.32.0.
Stored cross-site scripting in Karakeep 0.30.0 allows remote attackers to execute arbitrary JavaScript in users' browsers by injecting malicious HTML through the Reddit metascraper plugin, which bypasses sanitization that is applied to other content sources. The vulnerability exists because the Reddit plugin's HTML output is rendered directly via dangerouslySetInnerHTML without DOMPurify filtering, and public exploit code is available. Version 0.31.0 contains the patch.
OAuth Sign-In bypass in Karakeep up to version 0.32.0 allows unauthenticated remote attackers to subvert the authentication process via manipulation of logic in apps/web/server/auth.ts, achieving a low-integrity impact on the vulnerable system without requiring credentials or user interaction. High attack complexity (AC:H) means exploitation demands engineered conditions in the OAuth callback flow rather than trivial exploitation. No vendor patch has been issued at time of analysis; a public proof-of-concept has been disclosed via GitHub issue #2920 and indexed by VulDB, no public exploit identified at time of analysis for widespread automated campaigns but the PoC reduces the barrier for targeted attacks.
Unlimited authentication attempts against the karakeep login endpoint (apps/web/server/auth.ts) in versions up to 0.32.0 enable remote credential brute-forcing due to a missing rate-limiting guard on the NextAuth authorize function (CWE-307). The CVSS 4.0 score of 2.9 with AC:H reflects that successful exploitation depends on the target account holding a guessable password - a condition outside the attacker's direct control. A proof-of-concept has been publicly disclosed via GitHub issue #2919, though no active exploitation is confirmed by CISA KEV.
Server-side request forgery in Karakeep self-hosted bookmark manager versions prior to 0.32.0 allows authenticated users to bypass internal-network protections by chaining attacker-controlled HTTP redirects, reaching Docker-internal services from the crawler and video download flows. Publicly available exploit code exists per SSVC, though EPSS is low at 0.03% and the issue is not in CISA KEV. Fixed in version 0.32.0.
Stored cross-site scripting in Karakeep 0.30.0 allows remote attackers to execute arbitrary JavaScript in users' browsers by injecting malicious HTML through the Reddit metascraper plugin, which bypasses sanitization that is applied to other content sources. The vulnerability exists because the Reddit plugin's HTML output is rendered directly via dangerouslySetInnerHTML without DOMPurify filtering, and public exploit code is available. Version 0.31.0 contains the patch.
OAuth Sign-In bypass in Karakeep up to version 0.32.0 allows unauthenticated remote attackers to subvert the authentication process via manipulation of logic in apps/web/server/auth.ts, achieving a low-integrity impact on the vulnerable system without requiring credentials or user interaction. High attack complexity (AC:H) means exploitation demands engineered conditions in the OAuth callback flow rather than trivial exploitation. No vendor patch has been issued at time of analysis; a public proof-of-concept has been disclosed via GitHub issue #2920 and indexed by VulDB, no public exploit identified at time of analysis for widespread automated campaigns but the PoC reduces the barrier for targeted attacks.
Unlimited authentication attempts against the karakeep login endpoint (apps/web/server/auth.ts) in versions up to 0.32.0 enable remote credential brute-forcing due to a missing rate-limiting guard on the NextAuth authorize function (CWE-307). The CVSS 4.0 score of 2.9 with AC:H reflects that successful exploitation depends on the target account holding a guessable password - a condition outside the attacker's direct control. A proof-of-concept has been publicly disclosed via GitHub issue #2919, though no active exploitation is confirmed by CISA KEV.