CVE-2026-18311
MediumCVSS 6.1Summary
Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.
Risk Assessment
Risk of session hijacking or performing actions in the application context on victims' devices, potentially leading to data theft or unauthorized actions.
Recommendation
Update the app to a patched version that adds HTML sanitization before inserting metadata into WebView, and avoid opening documents from untrusted sources.
Other vulnerabilities in Readwise Reader
See all- CVE-2026-18320Medium
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script when rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).
- CVE-2026-18312Medium
Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content.
Original NVD description (English source)
Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS