{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-82642",
        "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "state": "PUBLISHED",
        "assignerShortName": "JFROG",
        "dateReserved": "2026-08-30T13:32:39.506Z",
        "datePublished": "2026-08-30T13:44:34.109Z",
        "dateUpdated": "2026-08-30T13:44:34.109Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
                "shortName": "JFROG",
                "dateUpdated": "2026-08-30T13:44:34.109Z"
            },
            "title": "Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-79",
                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "readest",
                    "product": "readest",
                    "platforms": [
                        "Windows",
                        "macOS",
                        "Linux"
                    ],
                    "collectionURL": "https://github.com/readest/readest",
                    "repo": "https://github.com/readest/readest",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "0.11.16",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the &lt;script&gt; tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on &lt;iframe&gt; elements, treating it as an opaque string attribute, so an attacker who can get an &lt;iframe&gt; element to survive sanitization can embed a complete HTML document containing a &lt;script&gt; tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.</p>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj",
                    "name": "GHSA-p4x7-pf2c-xrvj",
                    "tags": [
                        "vendor-advisory"
                    ]
                },
                {
                    "url": "https://github.com/readest/readest/pull/4762",
                    "name": "PR #4762",
                    "tags": [
                        "patch"
                    ]
                },
                {
                    "url": "https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb",
                    "name": "Fix commit 005aa2d6157a",
                    "tags": [
                        "patch"
                    ]
                },
                {
                    "url": "https://github.com/readest/readest/releases/tag/v0.11.16",
                    "name": "Release v0.11.16 (first fixed release)",
                    "tags": [
                        "release-notes"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "privilegesRequired": "NONE",
                        "userInteraction": "REQUIRED",
                        "scope": "UNCHANGED",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "availabilityImpact": "HIGH",
                        "baseSeverity": "HIGH",
                        "baseScore": 8.8,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
                    }
                }
            ],
            "workarounds": [
                {
                    "lang": "en",
                    "value": "Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>Only open EPUB files from trusted sources. Ensure the 'allow script' view setting remains disabled, as enabling it bypasses sanitization entirely.</p>"
                        }
                    ]
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "value": "Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>Upgrade to Readest 0.11.16 or later. The fix adds 'srcdoc' to the DOMPurify FORBID_ATTR list and 'iframe', 'object' and 'embed' to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.</p>"
                        }
                    ]
                }
            ],
            "timeline": [
                {
                    "time": "2026-06-23T00:00:00.000Z",
                    "lang": "en",
                    "value": "Reported to the Readest maintainers"
                },
                {
                    "time": "2026-06-24T14:01:00.000Z",
                    "lang": "en",
                    "value": "Fix committed (005aa2d6157a, PR #4762)"
                },
                {
                    "time": "2026-06-28T18:51:00.000Z",
                    "lang": "en",
                    "value": "Fix released in v0.11.16"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Yuval Moravchick, JFrog Security Research",
                    "type": "finder"
                }
            ],
            "source": {
                "discovery": "EXTERNAL"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.5"
            }
        }
    }
}