CVE-2026-18320 in Readwise
Summary
by MITRE • 09/25/2026
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Readwise Reader for Android stems from an overly permissive configuration within its HTML sanitization library. Specifically, the application utilizes a sanitize-html setup that includes a wildcard attribute rule applied to SVG and PATH elements. This technical misconfiguration allows all attributes on these specific markup structures to pass through the filtering process without validation or removal of dangerous payloads. In secure web development practices, input sanitization is critical for preventing injection attacks, yet this implementation fails to distinguish between benign visual styling attributes and executable script triggers. The core flaw lies in the failure to explicitly blacklist or strip event handler attributes such as onload, onerror, onclick, and similar JavaScript execution vectors from SVG content.
From a technical perspective, SVG elements are capable of executing scripts when rendered within modern web views if they contain active content like embedded JavaScript or event handlers that trigger script execution upon page load or user interaction. By permitting all attributes via the wildcard rule, the sanitizer inadvertently preserves these malicious payloads. When an attacker supplies a document containing crafted SVG code with injected event handlers, the sanitization process does not strip them out because it treats every attribute as permissible due to the broad scope of the configuration. Consequently, when this content is rendered in the Reader WebView, the browser engine interprets and executes the embedded scripts within the context of the application's domain or session cookies if available.
The operational impact of this vulnerability is significant, primarily manifesting as a client-side cross-site scripting (XSS) attack vector. An attacker who can influence the content displayed by Readwise Reader for Android could inject malicious SVG payloads that execute arbitrary JavaScript code in the victim's environment. This capability allows for session hijacking, where an attacker steals authentication tokens or cookies to impersonate the user. It also enables data exfiltration, allowing sensitive information stored locally on the device or accessed through web views to be sent to external servers controlled by the attacker. Furthermore, this could facilitate phishing attacks within the application interface or redirect users to malicious websites that mimic legitimate services, thereby compromising trust and security posture.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific mechanism here relates to insufficient validation of dynamic content within SVG structures, a subset often overlooked in general HTML sanitizers that focus primarily on standard DOM elements. In terms of the MITRE ATT&CK framework for mobile platforms, this falls under T1059.007 JavaScript and potentially T1204.002 Malicious File Execution if the script leads to further payload delivery. The lack of strict attribute filtering represents a failure in input validation controls that are essential for securing hybrid applications relying on web views.
To mitigate this vulnerability, developers must refine the sanitization configuration by removing or restricting the wildcard attribute rule for SVG and PATH elements. Instead of allowing all attributes, the sanitizer should employ an allowlist approach that explicitly permits only safe visual properties such as fill, stroke, width, height, and transform while strictly blocking any event handler attributes starting with on-. Additionally, implementing Content Security Policy (CSP) headers within the WebView can provide a secondary layer of defense by restricting script execution sources. Regular security audits of third-party libraries used for content rendering are also recommended to ensure that configuration updates from upstream maintainers do not reintroduce similar permissive rules. Updating to patched versions of the sanitization library, if available with stricter defaults, is critical for restoring secure input handling practices in the application.