CVE-2026-82642: Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBIDTAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.TAURIINTERNALS.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBIDTAGS and adding 'srcdoc' to FORBIDATTR.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Readestto a version that resolves this vulnerability.Fixed in 0.11.16 - Configuration
Add 'srcdoc' to the DOMPurify FORBID_ATTR list to prevent sanitization bypass via <iframe srcdoc>.
apps/readest-app/src/services/transformers/sanitizer.ts (DOMPurify configuration) FORBID_ATTR = ['srcdoc'] - Configuration
Harden EPUB chapter HTML sanitization by adding 'iframe', 'object', and 'embed' to the DOMPurify FORBID_TAGS list (the config already forbade only <script> in versions prior to 0.11.16).
apps/readest-app/src/services/transformers/sanitizer.ts (DOMPurify configuration) FORBID_TAGS = ['script','iframe','object','embed']
Event History
Frequently Asked Questions
Which Readest versions are affected?
Readest versions prior to 0.11.16 are affected. Version 0.11.16 blocks iframe, object, and embed elements and the srcdoc attribute in the EPUB sanitizer.
What must an attacker do to exploit this?
An attacker must cause a user to open EPUB content containing an iframe that survives sanitization and carries malicious HTML in its srcdoc attribute. User interaction is required according to the supplied CVSS vector.
Are users exposed when reading a malicious EPUB?
Yes. The malicious iframe can be made zero-size and transparent, allowing its script to execute while the user sees normal-looking book text. The iframe sandbox permits scripts and same-origin access, enabling access to Tauri IPC commands available to the application.
What is the impact of successful exploitation?
Script in the EPUB iframe can access parent.parent.__TAURI_INTERNALS__.invoke(...) and invoke Tauri IPC commands permitted to Readest. This can escalate to arbitrary code execution.
What can be done if upgrading is not immediately possible?
The provided information identifies the issue as being triggered by opening attacker-controlled EPUB content. Avoid opening untrusted EPUB files until Readest can be updated to 0.11.16 or later.