{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82642","assignerOrgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","state":"PUBLISHED","assignerShortName":"JFROG","dateReserved":"2026-08-30T13:32:39.506Z","datePublished":"2026-08-30T13:44:34.109Z","dateUpdated":"2026-08-31T16:45:59.286Z"},"containers":{"cna":{"providerMetadata":{"orgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","shortName":"JFROG","dateUpdated":"2026-08-30T13:44:34.109Z"},"title":"Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"affected":[{"vendor":"readest","product":"readest","platforms":["Windows","macOS","Linux"],"collectionURL":"https://github.com/readest/readest","repo":"https://github.com/readest/readest","versions":[{"status":"affected","version":"0","lessThan":"0.11.16","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the &lt;script&gt; tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on &lt;iframe&gt; elements, treating it as an opaque string attribute, so an attacker who can get an &lt;iframe&gt; element to survive sanitization can embed a complete HTML document containing a &lt;script&gt; tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.</p>"}]}],"references":[{"url":"https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj","name":"GHSA-p4x7-pf2c-xrvj","tags":["vendor-advisory"]},{"url":"https://github.com/readest/readest/pull/4762","name":"PR #4762","tags":["patch"]},{"url":"https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb","name":"Fix commit 005aa2d6157a","tags":["patch"]},{"url":"https://github.com/readest/readest/releases/tag/v0.11.16","name":"Release v0.11.16 (first fixed release)","tags":["release-notes"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}],"workarounds":[{"lang":"en","value":"Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.</p>"}]}],"solutions":[{"lang":"en","value":"Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.</p>"}]}],"timeline":[{"time":"2026-06-23T00:00:00.000Z","lang":"en","value":"Reported to the Readest maintainers"},{"time":"2026-06-24T14:01:00.000Z","lang":"en","value":"Fix committed (005aa2d6157a, PR #4762)"},{"time":"2026-06-28T18:51:00.000Z","lang":"en","value":"Fix released in v0.11.16"}],"credits":[{"lang":"en","value":"Yuval Moravchick, JFrog Security Research","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-31T16:45:50.271180Z","id":"CVE-2026-82642","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-31T16:45:59.286Z"}}]}}