Cross-Site Scripting in Wallabag Android App

Executive Summary

CVE-2026-82089 is a cross-site scripting (XSS) vulnerability in the Wallabag Android app through version 2.6.0. The issue occurs because article data loaded via the /api/entries endpoint is rendered in a WebView without proper sanitization. This allows malicious scripts to be stored and later executed when users view those articles.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in the Wallabag Android app, inspect network traffic for unvalidated HTML content loaded into WebView components. Check logs for suspicious script execution in article content. Review application code for improper HTML sanitization in ArticleUpdater.java and ReadArticleActivity.java.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject malicious scripts into articles you view. This might lead to unauthorized data access, session hijacking, or other malicious activities within the app. Since Wallabag stores user articles, the impact could affect your saved content and interactions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could compromise data confidentiality and integrity, potentially violating GDPR's requirements for protecting personal data and HIPAA's safeguards for sensitive health information. If exploited, it may lead to unauthorized access or disclosure of regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Wallabag Android app to the latest version. Implement strict HTML sanitization for article content before rendering in WebView. Disable automatic article updates until patches are applied. Monitor for unusual activity in stored articles.

Useful 0 Not Useful 0