CVE-2024-39307

3.5 lowEPSS 0.5%

Low (3.5). EPSS 0.5% chance of exploitation in the next 30 days.

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1.

Severity

CVSS 3.1

3.5 low

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-06-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84
https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84

Check your stack JSON