{"id":"CVE-2026-18320","title":"Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule","summary":"Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79","CWE-625"],"vendor":"Readwise","product":"Reader","affected":["Reader >= 8.7.2 < 8.10.1"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T17:17:08.013","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18320","references":[{"url":"https://kb.cert.org/vuls/id/699627","label":"cret@cert.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-25T16:56:55.358504Z"},"ingestedAt":"2026-09-25T17:13:14.012Z","slug":"CVE-2026-18320","body":"## Overview\n\nReadwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}