CVE-2026-42451: Grimmory Digital Library XSS Vulnerability

CVE-2026-42451 Overview

CVE-2026-42451 is a stored cross-site scripting (XSS) vulnerability in Grimmory, a self-hosted digital library application. The flaw resides in the browser-based EPUB reader, which fails to sanitize JavaScript embedded inside crafted EPUB files. When an authenticated user opens a malicious book, the attacker's script executes within the Grimmory session context. The maintainers patched the issue in version 2.3.1. The vulnerability is classified under CWE-79.

Critical Impact
Attackers can steal session tokens and hijack accounts. If an administrator opens an affected EPUB, the attacker gains administrative access to the Grimmory instance.

Affected Products

Grimmory self-hosted digital library prior to version 2.3.1
Grimmory browser-based EPUB reader component
Grimmory administrative sessions when an admin opens a malicious book

Discovery Timeline

2026-05-08 - CVE-2026-42451 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42451

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Grimmory's EPUB reader. EPUB files are ZIP archives containing XHTML, CSS, and metadata. Grimmory renders this content inside the user's browser without stripping or neutralizing active script content. An attacker who can upload a book to the library can therefore embed arbitrary JavaScript that runs in any reader's browser. Because the script executes inside the Grimmory origin, it has full access to authenticated session cookies, the document object model, and any API endpoint the user can call. Account takeover follows directly from session token theft, and a compromised administrator account grants control of the library instance.

Root Cause

The root cause is improper neutralization of input during web page generation in the EPUB rendering pipeline. Grimmory trusts the contents of uploaded EPUB documents and renders embedded HTML and JavaScript without sandboxing or sanitization. Standard mitigations such as Content Security Policy, sandboxed iframes, or DOM sanitizers were not enforced before version 2.3.1.

Attack Vector

Exploitation requires an attacker with permission to upload an EPUB file and a victim who opens that book. The attacker crafts an EPUB containing an XHTML payload with inline <script> tags or event handlers such as onerror or onload. The payload reads document.cookie or makes authenticated fetch requests against Grimmory endpoints, exfiltrating data to an attacker-controlled host. Targeting an administrator escalates the impact to full application takeover. No verified public proof-of-concept code is available; see the GitHub Security Advisory GHSA-frv6-5wq5-9p24 for additional technical context.

Detection Methods for CVE-2026-42451

Indicators of Compromise

EPUB files in the Grimmory library containing inline <script> tags, javascript: URLs, or event handler attributes such as onerror and onload in XHTML content documents.
Outbound HTTP requests from user browsers to unfamiliar domains immediately after opening a book in the reader.
Unexpected session creations or administrative actions originating from user-agent strings that match recent book-reading sessions.

Detection Strategies

Scan uploaded EPUB archives for embedded script tags, inline event handlers, and external resource references before allowing them into the library.
Review Grimmory application logs for administrator actions performed immediately after an admin account opened a recently uploaded book.
Compare hashes of EPUB files in the library against a known-good baseline to identify tampered or attacker-supplied uploads.

Monitoring Recommendations

Enable browser CSP violation reporting and forward reports to a central log store to surface inline script execution attempts.
Monitor authentication and session APIs for token reuse from unexpected IP addresses following EPUB reader activity.
Alert on new EPUB uploads from low-privileged or recently created accounts and queue them for inspection.

How to Mitigate CVE-2026-42451

Immediate Actions Required

Upgrade all Grimmory deployments to version 2.3.1 or later, available at the GitHub Release v2.3.1.
Rotate session tokens and force re-authentication for all users, especially administrators, after upgrading.
Audit the library for EPUB files uploaded by untrusted accounts and quarantine suspicious uploads pending review.

Patch Information

The Grimmory maintainers fixed CVE-2026-42451 in version 2.3.1. Refer to the GitHub Security Advisory GHSA-frv6-5wq5-9p24 for the official advisory and to the GitHub Release v2.3.1 for upgrade artifacts.

Workarounds

Restrict EPUB upload permissions to trusted administrators until the upgrade to 2.3.1 is complete.
Disable the in-browser EPUB reader and require users to download books for offline reading where feasible.
Deploy a strict Content Security Policy at the reverse proxy that blocks inline script execution within the Grimmory origin.

bash

# Configuration example: enforce strict CSP on the Grimmory reverse proxy
# Nginx snippet to block inline script execution in the EPUB reader origin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'" always;