CVE-2026-55408
Koodo Reader: Remote code execution via malicious epub file
CVSS Score
0.0
EPSS Score
0.2%
EPSS Percentile
9th
Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An attacker can craft an EPUB book that, when imported and opened by the victim, instantiates a hidden iframe with Node.js API access and executes arbitrary operating system commands with the victim user's privileges. This issue is fixed in version 2.3.1.
| CWE | CWE-94 |
| Vendor | koodo-reader |
| Product | koodo-reader |
| Published | Jul 7, 2026 |
| Last Updated | Jul 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for koodo-reader koodo-reader
Be the first to know when new unknown vulnerabilities affecting koodo-reader koodo-reader are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
koodo-reader / koodo-reader
< 2.3.1