AI analysis
Readwise Reader for Android uses a sanitize-html configuration with a wildcard rule that permits all attributes on SVG and PATH elements, so script-capable event handler attributes such as 'onload' and 'onerror' are not stripped. An attacker can craft a document containing malicious SVG content that survives sanitization and executes script when the document is rendered in the Reader WebView, yielding client-side cross-site scripting. Exploitation requires the victim to open a malicious document in the app (user interaction is required per the CVSS vector), and a successful attack gives the attacker limited confidentiality and integrity impact within the WebView context, such as stealing session data or manipulating displayed content. Users of Readwise Reader on Android, specifically version 8.7.2 identified in CERT/CC VU#699627, are affected. No public proof-of-concept exists and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.
What to do: Update Readwise Reader for Android to the latest version from Google Play as soon as a fixed release ships, since the data identifies 8.7.2 as vulnerable but does not specify a patched version number. Until patched, avoid saving or opening documents from untrusted or unknown sources in Reader, since exploitation requires rendering an attacker-supplied document. Monitor CERT/CC VU#699627 for vendor advisories and fixed-version details.
Affected
| Readwise Reader for Android | 8.7.2 (version identified in VU#699627; earlier versions may also be affected but are not confirmed in available data) |
Estimated exposure
moderatetens of thousands of Android app users (order of magnitude) — Readwise Reader's overall subscriber base is commonly estimated in the low hundreds of thousands across platforms, and the Android app is a subset of that; no official install counts were provided in the data, so this is a rough…
Description
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).