CVE-2026-55408 Overview
CVE-2026-55408 is a remote code execution vulnerability in Koodo Reader, an open-source ebook reader application. Versions 2.3.0 and earlier render EPUB chapter content using unsanitized innerHTML while the open-book Inter-Process Communication (IPC) handler enables nodeIntegrationInSubFrames. An attacker can craft a malicious EPUB file that spawns a hidden iframe with Node.js API access when the victim opens the book. The iframe executes arbitrary operating system commands under the victim user's privileges. The issue is tracked as [CWE-94] Improper Control of Generation of Code and is resolved in version 2.3.1.
Critical Impact
Opening a crafted EPUB file in Koodo Reader results in arbitrary command execution on the host operating system with the current user's privileges.
Affected Products
- Koodo Reader version 2.3.0 and earlier
- Electron-based desktop builds of Koodo Reader across supported platforms
- Installations that import EPUB files from untrusted sources
Discovery Timeline
- 2026-07-07 - CVE-2026-55408 published to the National Vulnerability Database
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-55408
Vulnerability Analysis
Koodo Reader is built on Electron, which combines Chromium rendering with Node.js runtime access. The open-book IPC handler configures the BrowserWindow with nodeIntegrationInSubFrames enabled. This setting grants Node.js API access to iframes nested inside the reader view. EPUB chapters are HyperText Markup Language (HTML) documents, and Koodo Reader injects that content into the DOM using unsanitized innerHTML assignment. An attacker who controls chapter markup controls the resulting DOM, including any iframes it contains. See the GitHub Security Advisory for the maintainer's technical description.
Root Cause
Two defects combine to produce code execution. First, the renderer trusts EPUB content and writes it into the document without sanitization or Content Security Policy (CSP) enforcement. Second, subframe Node integration exposes require, process, and the child_process module to any iframe inside the reader. Neither defect is exploitable alone, but together they let untrusted HTML reach a JavaScript context with full local Application Programming Interface (API) access.
Attack Vector
An attacker distributes a malicious EPUB through file sharing, email attachments, or ebook repositories. The victim imports the book and opens it inside Koodo Reader. The malicious chapter renders a hidden iframe whose script invokes Node.js modules such as child_process.exec to run arbitrary operating system commands. The attack requires user interaction to open the book but no additional privileges. The commands execute with the same rights as the local user account running Koodo Reader.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose based on the maintainer's advisory. See the GitHub Security Advisory for further technical detail.
Detection Methods for CVE-2026-55408
Indicators of Compromise
- EPUB files containing <iframe> tags with embedded scripts referencing require, process.mainModule, or child_process
- Koodo Reader child processes spawning shells such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash
- Unexpected outbound network connections initiated by the Koodo Reader process shortly after an EPUB import
- Newly created files or scheduled tasks written by the Koodo Reader process after opening a book
Detection Strategies
- Inspect EPUB archives before import and flag chapters that contain <script> blocks, <iframe> elements, or nodeIntegration references
- Alert on process creation events where Koodo Reader is the parent of an interpreter or command shell
- Monitor endpoint telemetry for child_process style command execution originating from Electron applications not expected to spawn shells
Monitoring Recommendations
- Baseline the normal child-process tree of Koodo Reader in your environment and alert on deviations
- Collect file-write and network-connect events tagged to the reader process for forensic review
- Track EPUB file provenance and log the source of any book imported from external storage or the web
How to Mitigate CVE-2026-55408
Immediate Actions Required
- Upgrade every Koodo Reader installation to version 2.3.1 or later without delay
- Remove or quarantine EPUB files received from untrusted sources until they can be inspected
- Restrict Koodo Reader execution to standard user accounts and avoid running it with administrative privileges
Patch Information
The Koodo Reader maintainers released version 2.3.1, which disables subframe Node integration for the reader view and sanitizes EPUB chapter content before rendering. Refer to the GitHub Security Advisory GHSA-mjr7-w4jq-2rq9 for release details and commit references.
Workarounds
- Do not open EPUB files from unknown senders or untrusted repositories until the update is applied
- Run Koodo Reader inside a sandbox, container, or dedicated low-privilege user account to limit blast radius
- Apply application allow-listing to block Koodo Reader from spawning shells or scripting interpreters
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
