CVE-2024-39307: Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-28 · updated 2026-06-17
Weakness: CWE-79

Description

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1.

Affected products

Kareadita Kavita: through 0.8.0

References

https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84
https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84

Get alerted when CVE-2024-39307 or the next vulnerability affects your stack