{"api_version":"1","generated_at":"2026-08-30T17:47:41+00:00","cve":"CVE-2026-82642","urls":{"html":"https://cve.report/CVE-2026-82642","api":"https://cve.report/api/cve/CVE-2026-82642.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-82642","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-82642"},"summary":{"title":"Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution","description":"Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.","state":"PUBLISHED","assigner":"JFROG","published_at":"2026-08-30 14:17:04","updated_at":"2026-08-30 14:17:04"},"problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":[{"version":"3.1","source":"reefs@jfrog.com","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj","name":"https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj","refsource":"reefs@jfrog.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/readest/readest/releases/tag/v0.11.16","name":"https://github.com/readest/readest/releases/tag/v0.11.16","refsource":"reefs@jfrog.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb","name":"https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb","refsource":"reefs@jfrog.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/readest/readest/pull/4762","name":"https://github.com/readest/readest/pull/4762","refsource":"reefs@jfrog.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82642","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82642","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"readest","product":"readest","version":"affected 0.11.16 semver","platforms":["Windows","macOS","Linux"]}],"timeline":[{"source":"CNA","time":"2026-06-23T00:00:00.000Z","lang":"en","value":"Reported to the Readest maintainers"},{"source":"CNA","time":"2026-06-24T14:01:00.000Z","lang":"en","value":"Fix committed (005aa2d6157a, PR #4762)"},{"source":"CNA","time":"2026-06-28T18:51:00.000Z","lang":"en","value":"Fix released in v0.11.16"}],"solutions":[{"source":"CNA","title":"","value":"Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Yuval Moravchick, JFrog Security Research","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://github.com/readest/readest","defaultStatus":"unaffected","platforms":["Windows","macOS","Linux"],"product":"readest","repo":"https://github.com/readest/readest","vendor":"readest","versions":[{"lessThan":"0.11.16","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Yuval Moravchick, JFrog Security Research"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the &lt;script&gt; tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on &lt;iframe&gt; elements, treating it as an opaque string attribute, so an attacker who can get an &lt;iframe&gt; element to survive sanitization can embed a complete HTML document containing a &lt;script&gt; tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.</p>"}],"value":"Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-30T13:44:34.109Z","orgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","shortName":"JFROG"},"references":[{"name":"GHSA-p4x7-pf2c-xrvj","tags":["vendor-advisory"],"url":"https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj"},{"name":"PR #4762","tags":["patch"],"url":"https://github.com/readest/readest/pull/4762"},{"name":"Fix commit 005aa2d6157a","tags":["patch"],"url":"https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb"},{"name":"Release v0.11.16 (first fixed release)","tags":["release-notes"],"url":"https://github.com/readest/readest/releases/tag/v0.11.16"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.</p>"}],"value":"Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts."}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-06-23T00:00:00.000Z","value":"Reported to the Readest maintainers"},{"lang":"en","time":"2026-06-24T14:01:00.000Z","value":"Fix committed (005aa2d6157a, PR #4762)"},{"lang":"en","time":"2026-06-28T18:51:00.000Z","value":"Fix released in v0.11.16"}],"title":"Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.</p>"}],"value":"Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely."}],"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","assignerShortName":"JFROG","cveId":"CVE-2026-82642","datePublished":"2026-08-30T13:44:34.109Z","dateReserved":"2026-08-30T13:32:39.506Z","dateUpdated":"2026-08-30T13:44:34.109Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-30 14:17:04","lastModifiedDate":"2026-08-30 14:17:04","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"82642","Ordinal":"1","Title":"Readest: unsanitized iframe srcdoc attribute in the EPUB sanitiz","CVE":"CVE-2026-82642","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"82642","Ordinal":"1","NoteData":"Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.","Type":"Description","Title":"Readest: unsanitized iframe srcdoc attribute in the EPUB sanitiz"}]}}}