CVE-2026-42451CWE-79CWE-80

Grimmory: Stored XSS via Malicious EPUB Enables Session Token Theft

Medium · published May 8, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in Grimmory's browser-based EPUB reader allows an attacker to embed arbitrary JavaScript in a crafted EPUB file. When a victim opens the book, the script executes in their browser with full access to the Grimmory application's session context. This can enable session token theft and account takeover, including administrative access if an administrator opens the affected book. This issue has been patched in version 2.3.1.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00147 · 3.6th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-05-08T22:51Z
EPSS history
Timeline
  • 08 MAY 22:51Z
    Grimmory: Stored XSS via Malicious EPUB Enables Session Token Theft
    cvelistv5