Please do not open a public GitHub issue for security vulnerabilities. To report a vulnerability, use GitHub's private vulnerability reporting feature for this repository, or email us at security@karakeep.app.
Security: karakeep-app/karakeep
Security
SECURITY.md
-
Non-constant-time comparison in API key and signed-asset-token verification enables timing attacksGHSA-hjm9-gc55-5hgv published
Aug 1, 2026 by MohamedBassemLow -
Stored XSS in Karakeep via Unsanitized Tag Names and `javascript:` URLs in Netscape Bookmark ExportGHSA-4vx2-9j8p-jg8v published
Aug 1, 2026 by MohamedBassemModerate -
Zod URL validator accepts javascript and data schemes in bookmark creationGHSA-6mfw-xrw2-h5x3 published
Aug 1, 2026 by MohamedBassemModerate -
HTML injection in list invitation email via unescaped list nameGHSA-pvj2-rgwm-r7f8 published
Aug 1, 2026 by MohamedBassemModerate -
SSRF in Karakeep workers via DNS-resolution TOCTOU between `dns.Resolver` and `dns.lookup`GHSA-vc53-r298-c6h6 published
Aug 1, 2026 by MohamedBassemModerate -
SSRF Protection Bypass via Redirect Handling in KarakeepGHSA-g647-327m-79g9 published
May 8, 2026 by MohamedBassemHigh -
SSRF via metascraper-logo-favicon bypasses validateUrl protectionsGHSA-7rx4-c5vx-g8w3 published
May 8, 2026 by MohamedBassemHigh -
Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSSGHSA-mg93-f9mw-wpgj published
Feb 22, 2026 by MohamedBassemHigh -
Current authentication flow is vulnerable to time based user enumerationGHSA-g49h-4fx9-9wmw published
Aug 23, 2025 by MohamedBassemLow -
Cross-Site Scripting within assets functionalityGHSA-7cj2-fr83-g2wj published
Aug 23, 2025 by MohamedBassemHigh
Learn more about advisories related to karakeep-app/karakeep in the GitHub Advisory Database