CVE-2026-27627

MEDIUM 6.1CVE-2026-27627 · Published 25/02/2026 · updated 17/06/2026

In short

CVE-2026-27627 is a MEDIUM (CVSS 6.1) vulnerability affecting karakeep (localhostlabs).
Chance of exploitation in the next 30 days (EPSS): 0.37%, higher than 31.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
karakeep localhostlabs	`= 0.30.0`	No fix yet

Description

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns `readableContentHtml`, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify, but the Reddit path skips both. Since this content ends up in `dangerouslySetInnerHTML` in the reader view, any malicious HTML in the Reddit response gets executed in the user's browser. Version 0.31.0 contains a patch for this issue.

References

karakeep-app/karakeep commit ba3db95 · Patch
karakeep-app/karakeep release v0.31.0 · Product
karakeep-app/karakeep security advisory · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free