Karakeep's Reddit metascraper plugin bypasses DOMPurify sanitization, resulting in stored cross‑site scripting when malicious HTML is returned from Reddit. The vulnerable plugin forwards redditContentHtml directly into dangerouslySetInnerHTML in the reader view, a path protected by no sanitization. This constitutes a classic stored XSS weakness (CWE‑79) that allows an attacker to execute arbitrary client‑side code for any user viewing the affected content.

The vulnerability affects Karakeep for version 0.30.0. The affected product is Karakeep, a locally‑hosted bookmark‑management application. The known CPE is cpe:2.3:a:localhostlabs:karakeep:0.30.0, and the vendor is listed as karakeep-app.

The CVSS score of 8.2 indicates high severity, and the EPSS score is below 1%, implying a very low, but non‑zero, likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can embed malicious scripts into Reddit posts that are parsed by the vulnerable plugin; when a user opens the Readable view, the browser executes the injected code. This results in client‑side compromise without requiring privileged system access, and can affect any user who views the affected Reddit content through Karakep.