Code Execution Vulnerability in Readest e-Book Reader by Tauri

CVE-2026-82642

What is CVE-2026-82642?

Readest, the open-source e-book reader developed on Tauri, has a vulnerability that allows an attacker to execute arbitrary code through an improperly configured HTML sanitization process. Specifically, in versions prior to 0.11.16, the application only excluded tags, failing to adequately sanitize elements. This oversight allows attackers to embed malicious script within the srcdoc attribute of iframes, which are granted permissions that enable them to interact with the parent application's internal commands. This can lead to significant security risks, including unauthorized access to sensitive IPC commands within the Tauri environment. The vulnerability was addressed in version 0.11.16, which improved the sanitizer configuration by including additional tags and attributes to the block list.

References