EUVD-2026-87231
GHSA-v29r-35gc-f5pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft SVG with onload/onerror handler
-
DeliveryDeliver as saved document to victim
-
ExploitVictim opens document in Reader WebView
-
ExecutionSanitizer wildcard permits handler attributes
-
PersistScript executes in WebView context
-
ImpactClient-side data access / session abuse
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open or render an attacker-supplied document containing malicious SVG/PATH markup inside the Readwise Reader Android app's WebView; the sanitize-html wildcard attribute rule must be active (present in affected versions Reader 8.7.2 up to but not including 8.10.1). Exploitation is limited by mandatory user interaction (the victim must add and view the crafted content), the requirement of a vulnerable app version, and the WebView-scoped impact rather than device-level compromise. No authentication of the attacker is needed to author the content, but delivery depends on getting the malicious document in front of the victim. |
| Impact | This is a genuine but moderate-severity client-side XSS (CWE-79) whose real-world risk signals are consistently low. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1) reflects an unauthenticated, network-delivered flaw that nonetheless requires user interaction (UI:R) - the victim must render an attacker-supplied document in the Reader WebView. SSVC reinforces low priority: Exploitation 'none' (no observed activity), Automatable 'no' (each victim must open malicious content), Technical Impact 'partial'. There is no CISA KEV listing and no public exploit code identified, so per the precision rules the status is 'no public exploit identified at time of analysis.' The C:L/I:L/A:N impact is appropriate for WebView-scoped script execution rather than full device compromise. No conflicting signals were found; all sources point the same direction. One note: the S:C (scope change) is defensible if script escaping the sanitized document context reaches the surrounding app WebView, but the confidentiality/integrity ceiling remains low. Overall this is a real, patch-worthy bug but not an urgent, widely-exploited priority. |
| Exploit ScenarioDerived | An attacker crafts a document (e.g., an article, email, or web page saved into Reader) containing malicious SVG markup whose event-handler attributes such as onload/onerror survive the flawed sanitize-html wildcard rule. When the victim opens that document in the Readwise Reader Android app, the WebView renders the SVG and executes the attacker's JavaScript in the app's rendering context. No public exploit code is currently identified, and successful attack requires the victim to actively open the crafted content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Client-side cross-site scripting in Readwise Reader for Android versions 8.7.2 up to but not including 8.10.1 lets an attacker craft a document containing malicious SVG markup whose event-handler attributes (such as 'onload' or 'onerror') survive the app's sanitize-html pass and execute inside the Reader WebView when the victim opens it. Exploitation requires user interaction - the victim must add and render the attacker-supplied document - and the impact is scoped to the WebView rather than the underlying device; the attacker needs no credentials to author the content, but delivery depends on getting it in front of the victim. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with partial technical impact, and the assessment places real-world risk at a moderate level consistent with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
RemediationAI
Vendor patch: a fix is available from the vendor, and the affected range in the coordinated advisory ends before Reader 8.10.1, so upgrading Readwise Reader for Android to 8.10.1 or later is the primary and most reliable remediation - the vendor advisory and coordination details are at https://kb.cert.org/vuls/id/699627. Because the flaw is a sanitization allowlist error rather than an isolated input, the fix should be validated by confirming that a crafted SVG/PATH document with 'onload' or 'onerror' attributes is stripped of those attributes after the update. Where immediate upgrade is not possible, the practical compensating controls are to avoid adding or opening untrusted documents, newsletters, RSS items, or web-clipped pages in affected versions (8.7.2 through 8.10.0), since exploitation requires the victim to render attacker-supplied content; the trade-off is that this degrades the core reading workflow but removes the delivery vector. Additionally, restricting the app's accessibility and any WebView-adjacent permissions or integrations limits the reach of script that does execute, at the cost of reduced functionality. Blocking or filtering inbound documents by source and treating syndicated content as untrusted input provides defense in depth, but none of these controls repair the sanitizer configuration itself, and the only complete fix is the vendor release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) arising from how Readwise Reader for Android configures the sanitize-html library. The configuration applies a wildcard attribute rule that permits all attributes on SVG and PATH elements instead of an allowlist. Because SVG elements support script-capable attributes, DOM event handlers such as 'onload' and 'onerror' are not stripped during sanitization, and the resulting markup is then rendered in the app's WebView. Any HTML/SVG rendering engine that honors those event attributes will execute the embedded script in the context of the Reader WebView, giving the attacker script execution against content rendered by the app. The CVSS vector records Scope Changed (S:C) because the vulnerable component (document sanitization) yields impact in the WebView rendering context, and Confidentiality and Integrity impacts are Low with no Availability impact, matching the limited, client-side nature of the flaw. The affected CPE is cpe:2.3:a:readwise:reader:*:*:*:*:*:*:*:*, which is version-agnostic, so version scoping must come from the affected-range data rather than the CPE string.
Know when Reader gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered malicious content, no attacker auth (PR:N) but victim must open it (UI:R); script escaping sanitized content into the WebView justifies S:C with limited C/I impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acro
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and
An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, ver
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, versio
Exploit-DB