CVE-2026-82089

CVE-2026-82089 is a cross-site scripting flaw (CWE-79) in the wallabag Android app (package fr.gaulupeau.apps.InThePoche) in all versions through 2.6.0. Data fetched from the /api/entries endpoint is loaded into a WebView without adequate sanitization, so script content embedded in an entry executes when the article is opened in the app's reader; the CVSS 4.0 vector (attack requirements present, low privileges, passive user interaction) indicates the attacker must first get crafted content into the victim's wallabag queue, for example by getting the victim to save a malicious page or by adding entries with account-level access to a shared instance. Successful exploitation yields arbitrary JavaScript execution in the app context, which the 8.8 (High) score rates as high impact to confidentiality and integrity on both the app and downstream resources, potentially exposing stored session tokens and app data. Affected users are anyone running the wallabag Android app version 2.6.0 or earlier that syncs with a self-hosted wallabag instance or the wallabag.it hosted service. No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS assigns a 0.3% probability of exploitation within 30 days, so exploitation has not been observed.

What to do: Update the wallabag Android app to a fixed release as soon as one is published; the data identifies all versions through 2.6.0 as vulnerable but names no fixed version, so check the project's Google Play/F-Droid listings for a release newer than 2.6.0. As interim mitigation, avoid opening untrusted saved entries in the app's built-in reader and prefer viewing the original page in an external browser, and verify the installed version via Android's app info screen.