CVE-2025-68467: Dark Reader Local Style Sheet Request Vulnerability
Summary
CVE-2025-68467: Dark Reader gives users the ability to request style sheets from local web servers. Affects darkreader versions < 4.9.117. Fixed in 4.9.117. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dark Reader is a popular browser extension that enables users to apply dark themes to websites, enhancing readability and reducing eye strain. It allows customization of styles and supports various browsers. However, versions prior to 4.9.117 have a vulnerability that permits websites to request style sheets from local web servers, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability in Dark Reader arises from its ability to allow websites to request style sheets from locally running web servers, such as 'http://localhost:8080/style.css'. This behavior can lead to unauthorized access to local resources, exposing sensitive data if a malicious website is able to exploit this feature. The issue was present in versions prior to 4.9.117 and is categorized under multiple CWEs, including CWE-200 (Information Exposure), CWE-346 (Origin Validation Error), and CWE-668 (Exposure of Resource to Wrong Sphere).
How To Fix
Latest published version: 4.9.133 as of 22 Oct 2026
npm install darkreader@4.9.133Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.9.117
This is the first release that contains the fix.
npm install darkreader@4.9.117Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to disable the Dark Reader extension until they can update to the patched version. Additionally, developers using custom forks should review their implementations to ensure secure handling of cross-origin requests.
Conclusion
The vulnerability identified as CVE-2025-68467 in Dark Reader allows unauthorized access to local resources through style sheet requests from websites. Users are strongly encouraged to update to version 4.9.117 or later to mitigate this risk. For those unable to update immediately, disabling the extension is recommended. Monitoring tools like Vulert can assist in keeping track of vulnerabilities in your software.
See every vulnerability recorded for darkreader →
FAQ
The vulnerability allows websites to request local style sheets, which can lead to unauthorized access to sensitive information on the user's machine.
You can check your version of Dark Reader in the extension settings under 'About' or through your browser's extensions page.
As a temporary measure, consider disabling the Dark Reader extension until you can update to the patched version.
No, the vulnerability does not affect developers using the 'darkreader' NPM package, but they should ensure proper handling of cross-origin requests.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file. You can also check your application for vulnerabilities using the Vulert playground without signing up.
