Executive brief
Koodo Reader is a cross-platform ebook reader application. A security flaw allows a specially crafted ebook file (EPUB) to run unauthorized commands on a user's computer when the file is opened. This could allow an attacker to take control of the system, steal data, or install malware with the same permissions as the person using the application.
Technical details
Koodo Reader (version 2.3.0 and earlier) is vulnerable to Remote Code Execution (RCE) due to an insecure Electron configuration and lack of input sanitization. The 'open-book' IPC handler enables 'nodeIntegrationInSubFrames', which grants Node.js API access to all nested iframes. Simultaneously, the application renders EPUB chapter content using unsanitized 'innerHTML'. An attacker can embed a hidden iframe containing a malicious script (e.g., using 'require(child_process)') within an EPUB file. When a victim opens the book, the script executes with the user's privileges. This issue is fixed in version 2.3.1 by disabling automatic Node.js integration in sub-frames.
Affected products
- Koodo Reader Koodo Reader <= 2.3.0
Timeline
- 2026-06-10: advisory: GitHub security advisory published by maintainer
- 2026-07-07: disclosed: CVE published to NVD