{"id":"CVE-2026-18311","revision":"47aca6652f8a43d7a37eda6a791dce33","records":[{"revision":"47aca6652f8a43d7a37eda6a791dce33","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-18311","aliases":[],"title":"CVE-2026-18311","description":"Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.","state":0,"publishedAt":"2026-09-25T16:27:54.187+00:00","modifiedAt":"2026-09-25T16:58:34.254+00:00","affected":[{"ecosystem":"Vendor product","name":"Reader","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Readwise\",\n                    \"product\": \"Reader\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"8.7.2\",\n                            \"lessThanOrEqual\": \"8.10.1\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://kb.cert.org/vuls/id/699627"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-18311","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-18311","identifiers":["CVE-2026-18311"]},"retained":false,"historicalAffected":[]}],"coverage":[]}