Koodo Reader
Monthly
Remote code execution in Koodo Reader (versions 2.3.0 and earlier) lets an attacker who supplies a malicious EPUB file run arbitrary OS commands with the victim's privileges once the book is imported and opened. The flaw combines a dangerously permissive Electron IPC handler (nodeIntegrationInSubFrames enabled) with unsanitized innerHTML rendering of chapter content, turning ebook display into a Node.js code-execution primitive. No public exploit has been identified at time of analysis; the issue is fixed in version 2.3.1 and is not listed in CISA KEV.
Path traversal in Koodo Reader 2.4.6 and earlier lets an authenticated user of the optional self-hosted HTTP server read arbitrary files outside the upload directory. The attacker uploads a crafted books.db whose 'cover' value contains ../ sequences and then requests /opds/cover/{key}, causing the server to serve a file readable by the Koodo Reader process; the same unsafe path construction affected the OPDS download handler. Exploitation requires the non-default OPDS/self-hosted mode to be deployed and reachable plus privileges sufficient to upload a database (PR:H), so impact is read-only disclosure of files the server process can already access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is contained in commit cbc79a1.
Remote code execution in Koodo Reader (versions 2.3.0 and earlier) lets an attacker who supplies a malicious EPUB file run arbitrary OS commands with the victim's privileges once the book is imported and opened. The flaw combines a dangerously permissive Electron IPC handler (nodeIntegrationInSubFrames enabled) with unsanitized innerHTML rendering of chapter content, turning ebook display into a Node.js code-execution primitive. No public exploit has been identified at time of analysis; the issue is fixed in version 2.3.1 and is not listed in CISA KEV.
Path traversal in Koodo Reader 2.4.6 and earlier lets an authenticated user of the optional self-hosted HTTP server read arbitrary files outside the upload directory. The attacker uploads a crafted books.db whose 'cover' value contains ../ sequences and then requests /opds/cover/{key}, causing the server to serve a file readable by the Koodo Reader process; the same unsafe path construction affected the OPDS download handler. Exploitation requires the non-default OPDS/self-hosted mode to be deployed and reachable plus privileges sufficient to upload a database (PR:H), so impact is read-only disclosure of files the server process can already access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is contained in commit cbc79a1.