CVE-2026-82642
Received Received - Intake

XSS via iframe srcdoc in Readest e-book reader

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: JFrog

Description
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82642
EUVD
EUVD-2026-68218

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
readest readest to 0.11.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in Readest, an open-source e-book reader. It occurs because the application sanitizes EPUB chapter HTML using DOMPurify but only blocks the <script> tag. Attackers can exploit this by embedding an <iframe> with a srcdoc attribute containing a malicious HTML document with a <script> tag. The iframe's sandbox settings allow script execution, granting access to Tauri IPC commands and enabling arbitrary code execution.

Detection Guidance

Check if your Readest version is prior to 0.11.16 by running: readest --version. Inspect network traffic for iframe srcdoc attributes in EPUB files. Monitor browser console logs for XSS attempts in Readest sessions.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on your system with the same permissions as the Readest application. This could lead to data theft, installation of malware, or unauthorized access to sensitive information. The attack can be hidden within a normal-looking e-book, making it difficult to detect.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for health information. A successful exploit could result in data breaches, triggering compliance penalties and legal consequences.

Mitigation Strategies

Upgrade Readest to version 0.11.16 or later immediately. Disable EPUB file processing from untrusted sources. Review and restrict Tauri IPC permissions in your application configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart