{"id":"CVE-2026-82642","state":"PUBLISHED","title":"Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution","description":"Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.","publishedAt":"2026-08-30T13:44:34.109Z","updatedAt":"2026-08-31T16:45:59.286Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"JFROG"},"assigner":"JFROG","products":["readest readest"],"affected":[{"vendor":"readest","product":"readest","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.11.16","versionType":"semver"}],"platforms":["Windows","macOS","Linux"],"collectionURL":"https://github.com/readest/readest","repo":"https://github.com/readest/readest"}],"references":["https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj","https://github.com/readest/readest/pull/4762","https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb","https://github.com/readest/readest/releases/tag/v0.11.16"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82642.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82642","state":"PUBLISHED","datePublished":"2026-08-30T13:44:34.109Z","dateUpdated":"2026-08-31T16:45:59.286Z","assignerShortName":"JFROG","assignerOrgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","dateReserved":"2026-08-30T13:32:39.506Z"},"containers":{"cna":{"title":"Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution","descriptions":[{"lang":"en","value":"Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR."}],"affected":[{"vendor":"readest","product":"readest","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.11.16","versionType":"semver"}],"platforms":["Windows","macOS","Linux"],"collectionURL":"https://github.com/readest/readest","repo":"https://github.com/readest/readest"}],"references":[{"url":"https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj","name":"GHSA-p4x7-pf2c-xrvj","tags":["vendor-advisory"]},{"url":"https://github.com/readest/readest/pull/4762","name":"PR #4762","tags":["patch"]},{"url":"https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb","name":"Fix commit 005aa2d6157a","tags":["patch"]},{"url":"https://github.com/readest/readest/releases/tag/v0.11.16","name":"Release v0.11.16 (first fixed release)","tags":["release-notes"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"JFROG","orgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","dateUpdated":"2026-08-30T13:44:34.109Z"},"workarounds":[{"lang":"en","value":"Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.</p>"}]}],"solutions":[{"lang":"en","value":"Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.</p>"}]}],"timeline":[{"time":"2026-06-23T00:00:00.000Z","lang":"en","value":"Reported to the Readest maintainers"},{"time":"2026-06-24T14:01:00.000Z","lang":"en","value":"Fix committed (005aa2d6157a, PR #4762)"},{"time":"2026-06-28T18:51:00.000Z","lang":"en","value":"Fix released in v0.11.16"}],"credits":[{"lang":"en","value":"Yuval Moravchick, JFrog Security Research","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-31T16:45:50.271180Z","id":"CVE-2026-82642","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-31T16:45:59.286Z"}}]}}}