CVE-2026-18320
MediumCVSS 6.1Summary
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script when rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).
Risk Assessment
A user can be attacked by a malicious document that, once synchronized to an Android device, executes script in the WebView context, potentially leading to data theft or session hijacking.
Recommendation
Update Readwise Reader for Android to the latest version that includes a fix for the sanitize-html configuration.
Other vulnerabilities in Readwise Reader
See all- CVE-2026-18312Medium
Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content.
- CVE-2026-18311Medium
Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.
Original NVD description (English source)
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS