Please do not open a public GitHub issue for security vulnerabilities. To report a vulnerability, use GitHub's private vulnerability reporting feature for this repository, or email us at security@karakeep.com.
Repository navigation
Security: karakeep-app/karakeep
Security
SECURITY.md
-
Authenticated infinite loop in recursive list deletion via cyclic parent referencesGHSA-892w-x93w-2fqp published
Oct 31, 2026 by MohamedBassemModerate -
karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEVGHSA-pp34-2c9r-mchw published
Oct 17, 2026 by MohamedBassemHigh -
Non-constant-time comparison in API key and signed-asset-token verification enables timing attacksGHSA-hjm9-gc55-5hgv published
Aug 1, 2026 by MohamedBassemLow -
Stored XSS in Karakeep via Unsanitized Tag Names and `javascript:` URLs in Netscape Bookmark ExportGHSA-4vx2-9j8p-jg8v published
Aug 1, 2026 by MohamedBassemModerate -
Zod URL validator accepts javascript and data schemes in bookmark creationGHSA-6mfw-xrw2-h5x3 published
Aug 1, 2026 by MohamedBassemModerate -
HTML injection in list invitation email via unescaped list nameGHSA-pvj2-rgwm-r7f8 published
Aug 1, 2026 by MohamedBassemModerate -
SSRF in Karakeep workers via DNS-resolution TOCTOU between `dns.Resolver` and `dns.lookup`GHSA-vc53-r298-c6h6 published
Aug 1, 2026 by MohamedBassemModerate -
SSRF Protection Bypass via Redirect Handling in KarakeepGHSA-g647-327m-79g9 published
May 8, 2026 by MohamedBassemHigh -
SSRF via metascraper-logo-favicon bypasses validateUrl protectionsGHSA-7rx4-c5vx-g8w3 published
May 8, 2026 by MohamedBassemHigh -
Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSSGHSA-mg93-f9mw-wpgj published
Feb 22, 2026 by MohamedBassemHigh
Learn more about advisories related to karakeep-app/karakeep in the GitHub Advisory Database