EUVD-2026-68218
GHSA-wvmc-79x2-m97w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
S:C selected over the provided S:U because script execution escapes the EPUB renderer into the host OS via Tauri IPC, crossing a meaningful security boundary beyond the vulnerable component.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
4DescriptionCVE.org
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.
AnalysisAI
Arbitrary code execution is achievable in Readest versions prior to 0.11.16 by embedding a malicious EPUB file that bypasses the application's DOMPurify-based HTML sanitizer via a crafted srcdoc attribute on an iframe element. DOMPurify treats srcdoc as an opaque string and does not sanitize its contents, allowing a complete HTML document containing JavaScript to survive sanitization and execute inside an iframe configured with sandbox="allow-same-origin allow-scripts"; the executing script can then call parent.parent.__TAURI_INTERNALS__.invoke() to access the full Tauri IPC command surface and achieve OS-level arbitrary code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running Readest in any version prior to 0.11.16 and must open an attacker-controlled EPUB file using the application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 base score with AV:N/AC:L/PR:N/UI:R reflects a realistic and low-complexity attack: the attacker's only requirement is delivering a malicious EPUB file that the victim opens, a routine activity for Readest's user base. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Readest version 0.11.16 or later; this is the vendor-confirmed patched release available at https://github.com/readest/readest/releases/tag/v0.11.16. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today