Readwise Reader EUVD-2026-87232

Exploitation requires: (1) the attacker to control document metadata fields - specifically the author meta tag - of a document that ends up in the victim's Readwise Reader library (via import or sharing of attacker-crafted content); (2) the missing HTML sanitization path where metadata is inserted into the app's WebView via innerHTML on Reader for Android versions 8.7.2 through 8.10.1; and (3) the victim opening the malicious document on a synced device, which is the required user interaction (UI:R). Limiting factors: it is not automatable at scale (each hit needs a victim to open specific crafted content), impact is confined to the WebView context with only partial confidentiality/integrity effect, and it affects the mobile client rather than server-side infrastructure.

This is a moderate-severity stored XSS (CVSS 6.1) in the Readwise Reader Android client, and the multi-source signals consistently point to LOW real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows network reachability and low complexity but requires user interaction (the victim must open the malicious document) and yields only partial confidentiality/integrity impact with no availability effect. CISA SSVC reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (each attack needs a victim to import and open crafted content), and Technical Impact=partial - a 'Track' rather than 'Act' outcome. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' No signals conflict here; all sources agree this is a real but bounded client-side flaw. The main caveat is data sparseness - the only reference is the CERT/CC vulnerability note, so patch/fixed-version details beyond the EUVD-listed affected range are not independently confirmed in the provided data.

An attacker crafts a document whose metadata (e.g., the author meta tag) contains a malicious HTML/JavaScript payload and gets it into a victim's Readwise Reader library - for example via a shared or importable document that syncs across the victim's devices. When the victim opens that document, the unsanitized metadata is injected into the app's WebView via innerHTML and the script executes in that WebView context. No public proof-of-concept is identified, and successful execution depends on the victim actually opening the malicious document (UI:R).