# CVE-2026-42451: Grimmory stored XSS in EPUB reader via insecure iframe sandbox

Source: https://junglewise.ai/threats/cve-2026-42451-grimmory-stored-xss-in-epub-reader-via-insecure-iframe-sandbox  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-42451 · Severity: medium · CVSS 6.3 · Published 2026-05-08

Grimmory is a self-hosted digital library for managing and reading electronic books. A security flaw in its built-in book reader allows a malicious actor to hide harmful code inside an EPUB file. If a user or administrator opens the infected book, the attacker can steal their login session, potentially leading to full account takeover and unauthorized access to the entire library.

Technologies: [Grimmory-Tools Grimmory](https://junglewise.ai/threats/technologies/grimmory). Vendors: [Grimmory-Tools](https://junglewise.ai/threats/vendors/grimmory-tools).

## Quick answers

**Is CVE-2026-42451 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42451 being exploited in the wild.

**How severe is CVE-2026-42451?** Medium severity, with a CVSS score of 6.3, published 8 May 2026.

**Which products and versions are affected?** Grimmory-Tools Grimmory < 2.3.1, <= 2.3.0.

**Is there a fix for CVE-2026-42451?** A patch was published on 2026-04-22: Fix merged and version 2.3.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42451 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-42451?** Check whether you run Grimmory-Tools Grimmory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Grimmory's browser-based EPUB reader due to an insecure iframe sandbox configuration. The application embeds the foliate-js reader using an iframe that simultaneously enables both 'allow-scripts' and 'allow-same-origin' attributes. This combination allows JavaScript within the EPUB (which is essentially a ZIP of HTML/JS) to bypass origin-based isolation and access the parent window's DOM and localStorage. An attacker with upload privileges can provide a malicious EPUB that, when viewed, exfiltrates session tokens or performs authenticated API requests on behalf of the victim. The vulnerability is addressed in version 2.3.1 by removing 'allow-scripts' from the iframe sandbox and implementing a Content Security Policy (CSP).

## Affected products

- grimmory-tools grimmory < 2.3.1

## Timeline

- 2026-03-19: disclosed: Vulnerability reported to Grimmory via GitHub private security disclosure
- 2026-04-22: patched: Fix merged and version 2.3.1 released
- 2026-05-08: advisory: CVE-2026-42451 published

## References

- [http://github.com/grimmory-tools/grimmory/releases/tag/v2.3.1](http://github.com/grimmory-tools/grimmory/releases/tag/v2.3.1)
- [https://github.com/grimmory-tools/grimmory/security/advisories/GHSA-frv6-5wq5-9p24](https://github.com/grimmory-tools/grimmory/security/advisories/GHSA-frv6-5wq5-9p24)

## Related threats

- [grimmory authorization bypass in Kobo download endpoint](https://junglewise.ai/threats/cve-2026-93955-a-vulnerability-was-detected-in-grimmory-tools-grimmory-up-to-3-3)
- [grimmory Settings API authorization bypass](https://junglewise.ai/threats/cve-2026-93954-a-security-vulnerability-has-been-detected-in-grimmory-tools)