PT-2026-82870 · Pocket · Pocket
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Pocket versions prior to 8.33.0.0
Description
The application is susceptible to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. This occurs because the "Save to Pocket" feature injects external HTML directly into the Document Object Model (DOM), which is the programming interface for HTML and XML documents. Consequently, JavaScript code can be used to modify the application state by utilizing native bridge methods.
Recommendations
Update to a version newer than 8.33.0.0.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pocket