CVE-2026-82642

Readest, an open-source e-book reader built on the Tauri framework, shipped a weak DOMPurify sanitizer configuration for EPUB chapter HTML that forbade only script tags in versions prior to 0.11.16. An attacker who can get a crafted EPUB opened by a victim can smuggle an iframe element through sanitization and embed a complete HTML document containing script inside its srcdoc attribute, which DOMPurify treats as an opaque string and does not sanitize. When the browser renders the iframe, the embedded script executes inside a sandbox that grants same-origin and scripts, letting it reach parent.parent.__TAURI_INTERNALS__.invoke and call any Tauri IPC command the application permits, which escalates to arbitrary code execution on the reader's device. The payload can be made invisible as a zero-size or transparent iframe, so the victim sees only normal book text while the code runs. All Readest users running versions before 0.11.16 are affected; no public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade Readest to version 0.11.16 or later, which hardens the sanitizer by adding iframe, object, and embed to FORBID_TAGS and srcdoc to FORBID_ATTR. As an interim mitigation, only open EPUB files from trusted sources, since exploitation requires a crafted book document. Given the high severity and low current exploitation probability, patch promptly before public PoCs or malicious samples appear.