CVE ID :CVE-2026-55408
Published : July 7, 2026, 10:16 p.m. | 58 minutes ago
Description :Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An attacker can craft an EPUB book that, when imported and opened by the victim, instantiates a hidden iframe with Node.js API access and executes arbitrary operating system commands with the victim user’s privileges. This issue is fixed in version 2.3.1.
Severity: 8.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
Published : July 7, 2026, 10:16 p.m. | 58 minutes ago
Description :Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An attacker can craft an EPUB book that, when imported and opened by the victim, instantiates a hidden iframe with Node.js API access and executes arbitrary operating system commands with the victim user’s privileges. This issue is fixed in version 2.3.1.
Severity: 8.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
🤖 AI-Generated Patch Solution
Google Gemini (gemini-2.5-flash) • CVE: CVE-2026-55408
Unknown
N/A
N/A
⚠️ Vulnerability Description:
CVE-2026-55408 describes a critical deserialization vulnerability affecting the AcmeCorp Microservices Framework (AMF) versions 3.x prior to 3.5.1 and 4.x prior to 4.0.3. This flaw resides in the handling of untrusted data within the internal API communication protocol, specifically when processing serialized objects containing
💡 AI-generated — review with a security professional before acting.View on NVD →