CVE-2026-18320: XSS
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Readwise Reader for Android users are exposed when they render a document containing attacker-supplied malicious SVG content in the Reader WebView.
What must an attacker provide to trigger the issue?
The attacker must supply a document containing SVG content with script-capable attributes, such as event handlers including onload or onerror, that survives the application's sanitization.