Android App
Monthly
Cross-site scripting in the wallabag Android application (fr.gaulupeau.apps.InThePoche) through version 2.6.0 allows execution of attacker-controlled JavaScript within the app's WebView. Article content fetched from the /api/entries endpoint is rendered in a WebView without sanitization, meaning malicious markup embedded in saved articles executes in the application's security context. A publicly available proof-of-concept references the specific vulnerable source files in the upstream repository; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 8.8 with scope change indicators reflects elevated real-world risk.
Cross-site scripting in the wallabag Android application (fr.gaulupeau.apps.InThePoche) through version 2.6.0 allows execution of attacker-controlled JavaScript within the app's WebView. Article content fetched from the /api/entries endpoint is rendered in a WebView without sanitization, meaning malicious markup embedded in saved articles executes in the application's security context. A publicly available proof-of-concept references the specific vulnerable source files in the upstream repository; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 8.8 with scope change indicators reflects elevated real-world risk.