Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution
Summary
| CVE | CVE-2026-82642 |
|---|---|
| State | PUBLISHED |
| Assigner | JFROG |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-30 14:17:04 UTC |
| Updated | 2026-08-30 14:17:04 UTC |
| Description | Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR. |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Problem Types: CWE-79 | CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj | [email protected] | github.com | |
| github.com/readest/readest/releases/tag/v0.11.16 | [email protected] | github.com | |
| github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb | [email protected] | github.com | |
| github.com/readest/readest/pull/4762 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Yuval Moravchick, JFrog Security Research (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-06-23T00:00:00.000Z | Reported to the Readest maintainers |
| CNA | 2026-06-24T14:01:00.000Z | Fix committed (005aa2d6157a, PR #4762) |
| CNA | 2026-06-28T18:51:00.000Z | Fix released in v0.11.16 |
Solutions
CNA: Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.
Workarounds
CNA: Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.
There are currently no legacy QID mappings associated with this CVE.