Grimmory's browser‑based EPUB reader contained a stored cross‑site scripting flaw that lets an attacker embed arbitrary JavaScript into a crafted EPUB file. When a user opens the book, the malicious script runs in the victim's browser with the same privileges as the Grimmory application, allowing access to the current session and the theft of authentication tokens. This can lead to full account takeover, and if an administrator opens the file, administrative control can also be compromised. The weakness is a classic client‑side XSS, mapped to CWE‑79 and CWE‑80.

All self‑hosted deployments of Grimmory prior to version 2.3.1 are affected. The issue is reported for the grimmory‑tools:grimmory product, and the advisory lists v2.3.1 as the patch release. Clients that use older releases must review their installation for this vulnerability.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score is currently unavailable and the vulnerability has not been cataloged in CISA's KEV list. The flaw is exploitable by uploading or injecting a malicious EPUB file that a targeted user then opens, so the likelihood depends on the user base and file sharing practices. Because the script executes in the victim's browser with full session context, an attacker could successfully hijack accounts without needing additional footholds.