Executive brief
Grimmory is a self-hosted digital library for managing and reading electronic books. A security flaw in its built-in book reader allows a malicious actor to hide harmful code inside an EPUB file. If a user or administrator opens the infected book, the attacker can steal their login session, potentially leading to full account takeover and unauthorized access to the entire library.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Grimmory's browser-based EPUB reader due to an insecure iframe sandbox configuration. The application embeds the foliate-js reader using an iframe that simultaneously enables both 'allow-scripts' and 'allow-same-origin' attributes. This combination allows JavaScript within the EPUB (which is essentially a ZIP of HTML/JS) to bypass origin-based isolation and access the parent window's DOM and localStorage. An attacker with upload privileges can provide a malicious EPUB that, when viewed, exfiltrates session tokens or performs authenticated API requests on behalf of the victim. The vulnerability is addressed in version 2.3.1 by removing 'allow-scripts' from the iframe sandbox and implementing a Content Security Policy (CSP).
Affected products
- grimmory-tools grimmory < 2.3.1
Timeline
- 2026-03-19: disclosed: Vulnerability reported to Grimmory via GitHub private security disclosure
- 2026-04-22: patched: Fix merged and version 2.3.1 released
- 2026-05-08: advisory: CVE-2026-42451 published