{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/699627#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nThree cross-site scripting (XSS) vulnerabilities identified in Readwise Reader for Android version 8.7.2 are disclosed. An attacker with the ability to craft malicious documents or metadata can exploit these vulnerabilities by supplying poisoned content that bypasses sanitization. Successful exploitation could allow the attacker to execute arbitrary JavaScript within the application's WebView context and compromise the confidentiality and integrity of user data, including access to stored documents, credentials, and session tokens.\r\n\r\n### Description\r\nReadwise Reader from Readwise is designed to provide a unified read-it-later service that helps individuals collect and organize articles, newsletters, videos, and other content of interest into a single reading interface. It is available on multiple platforms including Android and can synchronize content across devices.\r\n\r\n**CVE-2026-18311**: A stored cross-site scripting (XSS) vulnerability in the header rendering component in Readwise Reader for Android version 8.7.2 allows remote attackers to execute arbitrary JavaScript via crafted document metadata fields. The header rendering component is impacted due to insufficient HTML escaping of metadata fields such as 'doc.author' and 'doc.title', which allows malicious scripts to be stored in the user's library and synchronized to Android devices where they are executed in the WebView context.\r\n\r\n**CVE-2026-18312**: A stored cross-site scripting (XSS) vulnerability in the WebView URL construction logic in Readwise Reader for Android version 8.7.2 allows remote attackers to execute arbitrary JavaScript via malicious URL metadata. The WebView URL construction for X (formerly Twitter) video fallback and iOS paywall messages is impacted due to improper escaping of URL metadata before interpolation into `href` attributes, which allows user-controlled values to break out of the URL structure and inject script elements that are inserted into the DOM via `innerHTML`.\r\n\r\n**CVE-2026-18320**: A stored cross-site scripting (XSS) vulnerability in the article body sanitization component in Readwise Reader for Android version 8.7.2 allows remote attackers to execute arbitrary JavaScript via malicious SVG markup. The `sanitize-html` configuration is impacted due to a wildcard attribute rule that permits all attributes on SVG and PATH elements, which allows script-capable attributes such as `onload` and `onerror` to bypass sanitization. \r\n\r\n### Impact\r\nAn attacker with the ability to create or modify documents accessible to Readwise Reader can supply documents containing malicious metadata or markup that bypasses sanitization and is subsequently stored in users libraries. Because these documents are synchronized to Android devices and rendered within the Reader WebView, each vulnerability enables stored XSS: **CVE-2026-18311** and **CVE-2026-18312** through poisoned metadata, and **CVE-2026-18320** through malicious SVG markup.\r\n\r\n### Solution\r\n Unfortunately, the vendor could not be reached to coordinate this issue. Users should apply vendor updates as they become available (check Vendor Information section for updates) and keep Readwise Reader updated through the Google Play Store. As of publication, version 8.10.1 includes a patch that addresses the sanitizer-wildcard issue. Additionally, users should exercise caution when adding content from untrusted sources to their reading library and consider manually reviewing document metadata before saving articles to minimize exposure to malicious content.\r\n\r\n### Acknowledgements\r\nThanks to Zampier Zago (FUNFACTOR1) for reporting these vulnerabilities. This document was written by Alex Lewis.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/699627"}],"title":"Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities","tracking":{"current_release_date":"2026-09-25T16:59:44+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.49"}},"id":"VU#699627","initial_release_date":"2026-09-25 16:25:10.522034+00:00","revision_history":[{"date":"2026-09-25T16:59:44+00:00","number":"1.20260925165944.2","summary":"Released on 2026-09-25T16:59:44+00:00"}],"status":"final","version":"1.20260925165944.2"}},"vulnerabilities":[{"title":"Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata.","notes":[{"category":"summary","text":"Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened."}],"cve":"CVE-2026-18311","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#699627"}]},{"title":"Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule.","notes":[{"category":"summary","text":"Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS)."}],"cve":"CVE-2026-18320","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#699627"}]},{"title":"Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping.","notes":[{"category":"summary","text":"Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content, enabling stored cross-site scripting (XSS)"}],"cve":"CVE-2026-18312","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#699627"}]}],"product_tree":{"branches":[]}}