OpenReader

v4.2.2 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

deepinfra-api document epub epub-reader gpt-4o-mini-tts kitten-tts

+14 more

kokoro-tts markdown-reader open-ai open-ai-tts openai-api orpheus-tts pdf pdf-reader replicate-ai replicate-api supertonic text-to-speech tts txt-files

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 1mo

The release adds web page article import and a custom document creator tab while hardening security against SSRF in both web imports and speech generation.

Why it matters: Security enhancements block SSRF (severity 90 for web imports, severity 80 for speech) protecting data exfiltration; new import features expand workflow options.

Summary

AI summary

Updates ⚡ Improved, 🐛 Fixed, and 🚀 New across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevents SSRF and DNS rebinding via integrated AntiSSRF library for web imports. Prevents SSRF and DNS rebinding via integrated AntiSSRF library for web imports. Source: llm_adapter@2026-06-10 Confidence: high	—
Security	High	Prevents SSRF in speech generation by restricting audio retrieval to replicate.delivery subdomains. Prevents SSRF in speech generation by restricting audio retrieval to replicate.delivery subdomains. Source: llm_adapter@2026-06-10 Confidence: high	—
Feature
Feature	Medium	Adds Web Page Article Import from public URLs. Adds Web Page Article Import from public URLs. Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Medium	Adds Custom Document Creator tab for manual Markdown/Plain Text entry. Adds Custom Document Creator tab for manual Markdown/Plain Text entry. Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Low	Redesigns settings panel and document upload flow with responsive SidebarDialog component. Redesigns settings panel and document upload flow with responsive SidebarDialog component. Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Low	Redesigns text and markdown preview cards with radial dot pattern and smoother gradients. Redesigns text and markdown preview cards with radial dot pattern and smoother gradients. Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Low	Changes default HTML reader page layout width to 50% for better readability. Changes default HTML reader page layout width to 50% for better readability. Source: llm_adapter@2026-06-10 Confidence: high	—
Performance	Low	Advises client connections to back off before reconnecting, allowing compute workers to sleep efficiently. Advises client connections to back off before reconnecting, allowing compute workers to sleep efficiently. Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes uploader click registration bug in the "Upload Files" tab. Fixes uploader click registration bug in the "Upload Files" tab. Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Resolves webpack compilation failures in Docker by excluding native canvas package server‑side. Resolves webpack compilation failures in Docker by excluding native canvas package server‑side. Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Low	Cleans bullet points and non‑spoken symbols from text before sending to speech engines. Cleans bullet points and non‑spoken symbols from text before sending to speech engines. Source: granite4.1:30b@2026-06-10-audit Confidence: low	—

Full changelog

✨ What's New

🚀 New

Web Page Article Import: You can now import documents directly from any public webpage using their URL. OpenReader retrieves the page, cleans up headers, ads, and sidebars, and converts the content into clean Markdown (part of PR #116).
Custom Document Creator: Added a new tab to create clean Markdown or Plain Text documents from scratch directly in the app. This addresses the request to manually add text rather than always uploading a file (resolves #108, PR #116).
SSRF Prevention & URL Safety: Integrated the Microsoft AntiSSRF library to validate all web imports. The system prevents server-side request forgery (SSRF) and DNS rebinding attacks, ensuring safe imports by manually tracking redirects and blocking access to internal network IP ranges (PR #116).

⚡ Improved

Modern Modal & Sidebar Layouts: Redesigned the settings panel and document upload flow using a new SidebarDialog component, offering a unified, responsive design that works beautifully on both desktop and mobile devices (PR #116).
Optimized Text Preview Cards: Redesigned text and markdown file preview cards in the document finder window. They now feature a stylized radial dot pattern, smoother visual fade gradients, and better text alignment to let you preview document snippets at a glance (PR #116).
Smart Worker Connection Handling: The compute worker's server-sent event (SSE) stream now advises client connections to back off before reconnecting. When the worker is disconnected or goes idle, this delay prevents the client from immediately waking up the server, allowing the compute environment to sleep efficiently (PR #115).
Optimized Default Reader Width: Changed the default HTML reader page layout width to 50% instead of 100% to significantly improve readability out of the box (PR #116).

🐛 Fixed

Uploader Click bug: Fixed a bug introduced with the new document uploader menu where the "Click to select files" box in the "Upload Files" tab did not register mouse clicks.
Docker Webpack Build compilation: Resolved webpack compilation failures in Docker environments by dynamically excluding the native canvas package on the server and fallback-aliasing to @napi-rs/canvas.
Speech Generation Bullet Marker Cleanup: Added a clean-up pattern that strips bullet points, asterisks, list markers, and other non-spoken symbols (e.g. •, ▪, ★) from input text before sending it to speech engines. This prevents strict TTS servers (such as Supertonic) from failing due to unsupported character errors (resolves #113, PR #114).
Replicate Audio Output SSRF Prevention: Guarded speech generation against SSRF vulnerabilities by ensuring that audio files generated by Replicate models are strictly retrieved from replicate.delivery and its subdomains.

Full Changelog: https://github.com/richardr1126/openreader/compare/v4.2.1...v4.2.2

Security Fixes

Replicate Audio Output SSRF prevention ensures audio files are fetched only from replicate.delivery subdomains
Web page import flow now uses MS AntiSSRF library to prevent SSRF and DNS rebinding attacks

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track OpenReader

Get notified when new releases ship.

About OpenReader

EPUB, PDF, DOCX, MD, and TXT file text to speech document reader. Read documents in realtime with high-quality TTS; or extract audiobooks.

All releases →

Related context

Related tools

Earlier breaking changes

v4.0.0 Legacy `/api/whisper` path and old `whisper.cpp` integration removed from active runtime.
v4.0.0 Auth is now required; set BASE_URL and AUTH_SECRET before starting v4.