karakeep
v0.34.1A self-hostable bookmark-everything app (links, notes and images) with AI-based automatic tagging and full text search
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 12 advisories5 high, 5 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
30.5k stars · 1.6k forks · 721 open issues · last release 24 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 12 most recent advisories published by the maintainers: 5 high, 5 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-892w-x93w-2fqpOct 31, 2026Authenticated infinite loop in recursive list deletion via cyclic parent references
- Affected
- 0.33.2
- Patched in
- 0.34.0
- highGHSA-pp34-2c9r-mchwOct 17, 2026karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV
- Affected
- <= 151.0.7922.47-r1
- mediumGHSA-vc53-r298-c6h6Aug 1, 2026SSRF in Karakeep workers via DNS-resolution TOCTOU between `dns.Resolver` and `dns.lookup`
- Affected
- 0.32.0
- Patched in
- 0.33.1
- mediumGHSA-pvj2-rgwm-r7f8Aug 1, 2026HTML injection in list invitation email via unescaped list name
- Affected
- <= 0.32.0
- mediumGHSA-6mfw-xrw2-h5x3Aug 1, 2026Zod URL validator accepts javascript and data schemes in bookmark creation
- Affected
- <= 0.32.0
- mediumGHSA-4vx2-9j8p-jg8vAug 1, 2026Stored XSS in Karakeep via Unsanitized Tag Names and `javascript:` URLs in Netscape Bookmark Export
- Affected
- <= 0.32.0
- Patched in
- 0.33.1
- lowGHSA-hjm9-gc55-5hgvAug 1, 2026Non-constant-time comparison in API key and signed-asset-token verification enables timing attacks
- Affected
- <= 0.32.0
- Patched in
- 0.33.1
- highGHSA-7rx4-c5vx-g8w3May 8, 2026SSRF via metascraper-logo-favicon bypasses validateUrl protections
- Affected
- <= 0.31.0
- Patched in
- 0.32.0
- highCVE-2026-45082May 8, 2026SSRF Protection Bypass via Redirect Handling in Karakeep
- Affected
- < 0.32.0
- Patched in
- 0.32.0
- highCVE-2026-27627Feb 22, 2026Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS
- Affected
- == 0.30.0
- Patched in
- >= 0.31.0
- highGHSA-7cj2-fr83-g2wjAug 23, 2025Cross-Site Scripting within assets functionality
- Affected
- 0.25.0
- Patched in
- 0.27.0
- lowGHSA-g49h-4fx9-9wmwAug 23, 2025Current authentication flow is vulnerable to time based user enumeration
- Affected
- 0.25.0
- Patched in
- 0.26.0