Pocket · Pocket · CVE-2026-82090
**Name of the Vulnerable Software and Affected Versions**
Pocket versions prior to 8.33.0.0
**Description**
The application is susceptible to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. This occurs because the "Save to Pocket" feature injects external HTML directly into the Document Object Model (DOM), which is the programming interface for HTML and XML documents. Consequently, JavaScript code can be used to modify the application state by utilizing native bridge methods.
**Recommendations**
Update to a version newer than 8.33.0.0.