CVE-2026-82642

Name of the Vulnerable Software and Affected Versions Readest versions prior to 0.11.16

Description EPUB chapter HTML is sanitized using DOMPurify with a configuration that only forbids the <script> tag in the apps/readest-app/src/services/transformers/sanitizer.ts file. Because DOMPurify treats the srcdoc attribute of <iframe> elements as an opaque string without parsing its contents, an attacker can embed a full HTML document containing a <script> tag within the srcdoc attribute. Since the iframe is configured with sandbox="allow-same-origin allow-scripts", the executed script shares the parent origin and can access parent.parent. TAURI INTERNALS .invoke(...). This allows the attacker to use any Tauri IPC (Inter-Process Communication) command available to the application, leading to arbitrary code execution. The malicious iframe can be made invisible to the user.

Recommendations Update to version 0.11.16.