GHSA-7RX4-C5VX-G8W3 Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections

Summary The metascraper-logo-favicon plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application's validateUrl SSRF protections. This allows any authenticated user to make the server fetch arbitrary internal URLs by bookmarking a page containin...

Server-side Request Forgery (SSRF)

Overview @karakeep/sdk is a Typescript SDK for Karakeep Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the metascraper-logo-favicon process. An attacker can cause the server to make unauthorized HTTP requests to internal or sensitive network resources by...

Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections

Summary The metascraper-logo-favicon plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application's validateUrl SSRF protections. This allows any authenticated user to make the server fetch arbitrary internal URLs by bookmarking a page containin...

PT-2026-42985

Summary The metascraper-logo-favicon plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application's validateUrl SSRF protections. This allows any authenticated user to make the server fetch arbitrary internal URLs by bookmarking a page containin...

CVE-2026-27627

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns readableContentHtml, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify,...

CVE-2026-27627 Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns readableContentHtml, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify,...

CVE-2026-27627 Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns readableContentHtml, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify,...

CVE-2026-27627

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns readableContentHtml, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify,...

PT-2026-21852

Name of the Vulnerable Software and Affected Versions Karakeep version 0.30.0 Description Karakeep is an elf-hostable bookmark-everything app. Version 0.30.0 does not properly sanitize HTML content received from the Reddit metascraper plugin. Specifically, when the plugin returns...

CVE-2026-27627: Improper Neutralization of Input During Web Page Generation

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns readableContentHtml, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify,...

metascraper before v5.2.0 vulnerable to stored cross-site scripting

Versions of metascraper prior to 5.2.0 are vulnerable to stored cross-site scripting XSS. Recommendation Upgrade to version 5.2.0 or later...

GHSA-8F64-Q7JC-CCGP metascraper before v5.2.0 vulnerable to stored cross-site scripting

Versions of metascraper prior to 5.2.0 are vulnerable to stored cross-site scripting XSS. Recommendation Upgrade to version 5.2.0 or later...

@petitchevalroux/canonical-url (1.0.0), @sergiodxa/cli (>=1.0.0, <=1.1.0) +12 more potentially affected by CVE-2018-3773 via metascraper (>=1.0.7, <=4.10.3)

metascraper NPM version =1.0.7, =1.0.0, =1.1.0, =1.0.0, =2.0.0-rc.1, =1.0.0, =16.0.54, =18.0.3, =16.0.52, =1.0.0, =0.2.2, =0.3.8 - whorl 0.0.1 Source cves: CVE-2018-3773 Source advisory: MEND:CVE-2018-3773...

PT-2018-16191 · Npm · Metascrape

Name of the Vulnerable Software and Affected Versions: metascraper versions prior to 5.2.0 metascrape npm module versions = 3.9.2 Description: The issue is related to a stored Cross-Site Scripting vulnerability in Open Graph meta properties. It affects the metascrape npm module and metascraper...

Cross-Site Scripting

Overview Versions of metascraper prior to 5.3.0 are vulnerable to stored cross-site scripting XSS. Recommendation Upgrade to version 5.3.0 or later. References - HackerOne Report - GitHub Advisory...

Cross-site Scripting (XSS)

metascraper is vulnerable to cross-site scripting XSS attacks. The library does not sanitize its input, allowing a malicious user to inject and execute arbitrary code by means of a website that is scraped by the library...

Node.js third-party modules: [metascraper] Stored XSS in Open Graph meta properties read by metascrapper

Hi Guys, metascrapper is vulnerable to Stored XSS via Open Graph metadata, if they are used in HTML without any sanitization. Module: A library to easily scrape metadata from an article on the web using Open Graph metadata, regular HTML metadata, and series of fallbacks...