CVE-2026-18320

Deferred Deferred - Pending Action

Cross-Site Scripting in Readwise Reader for Android

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: CERT/CC

Description

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-18320

EUVD

EUVD-2026-87231

Affected Vendors & Products

Vendor	Product	Version / Range
readwise	reader	android

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Readwise Reader for Android has a security flaw where its HTML sanitization allows all attributes on SVG and PATH elements due to a wildcard rule. This means malicious attributes like event handlers (e.g., onload, onerror) are not removed, enabling script execution in the WebView when rendering SVG content. This results in a client-side cross-site scripting (XSS) vulnerability.

Detection Guidance

This vulnerability involves malicious SVG content bypassing HTML sanitization in Readwise Reader for Android. To detect it, inspect network traffic for SVG files with embedded event handlers like 'onload' or 'onerror'. Check application logs for unusual script execution in WebView contexts. No specific commands are provided in the given context.

Impact Analysis

An attacker could exploit this to inject malicious scripts into content displayed in Readwise Reader. If you view such content, the script could steal sensitive data, perform actions on your behalf, or redirect you to malicious sites. This could compromise your account, personal information, or device security.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using Readwise Reader may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update Readwise Reader for Android to the latest version that fixes the sanitize-html configuration issue. Avoid rendering untrusted SVG content in the app's WebView. Disable JavaScript in the WebView if possible or restrict it to trusted sources only.

Hi! I’m here to help you understand CVE-2026-18320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70