Stored Cross-Site Scripting Vulnerability in Readwise Reader for Android
CVE-2026-18312

6.1MEDIUM

Key Information:

Vendor

Readwise

Status
Reader
Vendor
CVE Published:
25 September 2026

What is CVE-2026-18312?

Readwise Reader for Android contains a vulnerability that arises from the improper handling of metadata during URL construction. By directly interpolating untrusted values into URL strings without appropriate encoding or escaping, the application risks allowing an attacker to inject script content. This can occur when a malicious actor crafts specific metadata, which upon synchronization to an Android device, gets rendered in the WebView. The result is a potential execution of unintended scripts through stored cross-site scripting, posing serious security risks to users.

Affected Version(s)

Reader 8.7.2 <= 8.10.1

References

https://kb.cert.org/vuls/id/699627

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.