CVE-2026-55408: koodo-reader, инжекция

Описание

Оригинално описание

Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An attacker can craft an EPUB book that, when imported and opened by the victim, instantiates a hidden iframe with Node.js API access and executes arbitrary operating system commands with the victim user's privileges. This issue is fixed in version 2.3.1.

Засегнати продукти

• koodo-reader koodo-reader: < 2.3.1

Вид слабост

• CWE-94 Неправилен контрол при генериране на код

История

Други уязвимости в koodo-reader koodo-reader

• 6.9CVE-2026-121544

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-55408
• https://nvd.nist.gov/vuln/detail/CVE-2026-55408
• https://github.com/koodo-reader/koodo-reader/security/advisories/GHSA-mjr7-w4jq-2rq9