EUVD-2026-67402
GHSA-c6wm-f83x-r49p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green
Network-fetched stored XSS with low-privilege article injection and scope change into WebView context; user must open article.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green
Lifecycle Timeline
2DescriptionCVE.org
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
AnalysisAI
Cross-site scripting in the wallabag Android application (fr.gaulupeau.apps.InThePoche) through version 2.6.0 allows execution of attacker-controlled JavaScript within the app's WebView. Article content fetched from the /api/entries endpoint is rendered in a WebView without sanitization, meaning malicious markup embedded in saved articles executes in the application's security context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to inject malicious content into an article visible to the victim's wallabag account - requiring either low-privilege authenticated access to the wallabag backend (PR:L per CVSS) or the ability to cause the victim to save a URL whose content contains a script payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L) reflects a network-reachable, low-complexity flaw requiring low privileges and passive user interaction, with high confidentiality and integrity impact across both the vulnerable system and a subsequent system - indicating the WebView scope-change concern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The GitHub security advisory GHSA-q2g2-www6-wf5h is the canonical vendor reference and should be checked for an official patched release version, which was not independently confirmed from the input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all users or deployments of wallabag versions 2.6.0 and earlier, communicate the vulnerability to affected users, and implement restrictions on app distribution if internally deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today