2.6 KiB
karakeep — triage (pins ghcr.io/karakeep-app/karakeep:0.33.2, ghcr.io/karakeep-app/karakeep-chrome:151.0.7922.47-r1; meilisearch v1.41.0 untouched)
Template: setup_gate: true + signup_block (signup + tRPC users.create). Browser: our compose uses karakeep-chrome:151.0.7922.47-r1
(BROWSER_WEB_URL=http://karakeep-chrome:9222, internal network only) — EXACTLY the vulnerable image.
Notices
- GHSA-pp34-2c9r-mchw — REAL. high (two CISA-KEV V8 bugs CVE-2026-85046 / CVE-2026-87491, Chromium started with --no-sandbox).
Login: any user (anyone who can save a bookmark/RSS feed makes the crawler open the page; a hostile page needs no account of its own).
Reachable: yes — through content the household saves; strangers cannot submit URLs (gate + signup_block).
The GHSA lists no patched version, BUT the registry now has
karakeep-chrome:154.0.8037.57-r1and156.0.8078.47-r1(>= 153.0.8010.36 = both fixed). v0.34.x source (docker/chrome/Dockerfile) pins GOOGLE_CHROME_VERSION=154.0.8037.57 on debian trixie-slim (Google Chrome on amd64; arm64 falls back to Debian's chromium — version not pinned, unsure if >=153 on arm64). - release:v0.34.1 — REAL runtime fix: node:24-slim (24.22.1), Oct-2026 Node security release (Brotli OOB write, TLS hostname bypasses).
- release:v0.34.0 — REAL: Next.js 16.4.1 October security release (#3196) + GHSA-892w-x93w-2fqp (list cycle → infinite loop, any user; not in the watch's list).
Fix
Smallest: chrome image 154.0.8037.57-r1. TARGET: ghcr.io/karakeep-app/karakeep:0.34.1 + ghcr.io/karakeep-app/karakeep-chrome:154.0.8037.57-r1
(the pair v0.34.1 ships; 156.0.8078.47-r1 also exists, unsure which karakeep release it is tested with). Tags verified on ghcr (no v prefix).
Same main (0): yes.
Breaking (0.34.0, 0.34.1 read): auth library next-auth → better-auth (automatic DB migration), EVERY web user signed out once; emails lowercased
in DB — two accounts differing only by case lock the user out (manual fix before upgrade); new optional AUTH_TRUSTED_ORIGINS; chrome image is now
full Google Chrome (bigger; 768M limit and the bash healthcheck must be re-measured); crawler driven by patchright.
Lane: BIG_STEP (forced sign-out + auth data conversion + rebuilt browser image). A chrome-only bump (151 → 154) with app 0.33.2 is
unsure: not tested upstream as a pair (the GHSA reporter's own replacement image did work with 0.33.2).
Classifier note: "no fixed version named yet" is stale — the karakeep-chrome registry has 154/156 tags past the KEV fixes; the watch should read
the chrome image's registry tags against the advisory's fixed Chromium version.