CVE-2026-18320

Name of the Vulnerable Software and Affected Versions Readwise Reader for Android (affected versions not specified)

Description The application uses a sanitize-html configuration that allows all attributes on SVG and PATH elements through a wildcard rule. This fails to strip script-capable attributes, such as event handlers like onload and onerror. An attacker can provide a document with malicious SVG content that bypasses sanitization and executes scripts when rendered in the Reader WebView, leading to client-side cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.