What’s Vulnerable › Vulnerabilities

CVE-2026-55408: Koodo Reader: Remote code execution via malicious epub file

• Severity: high (CVSS 8.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-07-08
• Weakness: CWE-94

Description

Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An attacker can craft an EPUB book that, when imported and opened by the victim, instantiates a hidden iframe with Node.js API access and executes arbitrary operating system commands with the victim user's privileges. This issue is fixed in version 2.3.1.

Affected products

• koodo-reader: before 2.3.1

References

• https://github.com/koodo-reader/koodo-reader/security/advisories/GHSA-mjr7-w4jq-2rq9
• https://github.com/koodo-reader/koodo-reader/security/advisories/GHSA-mjr7-w4jq-2rq9

Get alerted when CVE-2026-55408 or the next vulnerability affects your stack