Cross-Site Scripting Vulnerability in wallabag Android App by Wallabag

CVE-2026-82089

What is CVE-2026-82089?

The wallabag Android application, through versions up to 2.6.0, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This issue arises because the application loads data into a WebView without adequate sanitization. As a result, potentially malicious content can be executed in the web context of the app. Specific files responsible for this vulnerability include 'ReadArticleActivity.java,' where unsanitized HTML is rendered, and 'ArticleUpdater.java,' where content is stored unsanitized in the local database. Additionally, other impacted areas include file handling with 'ArticleAsFileDownloader.java' and 'StorageHelper.java,' which can lead to unauthorized access to exported files. The potential risks of this vulnerability necessitate immediate attention to manage the exposure of sensitive information.

References