CVE-2026-18311

6.1 Moyenne

Publiée le 25/09/2026 à 19:17 · Modifiée le 28/09/2026 à 18:31 · Analyse NVD reportée · Source : cret@cert.org

Description

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.

Traduire en français

Produits concernés

Readwise Reader

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://kb.cert.org/vuls/id/699627

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories