{"id":"CVE-2026-18320","revision":"35295ead1b70470aa43decf6b06c06f6","records":[{"revision":"35295ead1b70470aa43decf6b06c06f6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-18320","aliases":[],"title":"CVE-2026-18320","description":"Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).","state":0,"publishedAt":"2026-09-25T16:27:37.419+00:00","modifiedAt":"2026-09-25T16:57:42.082+00:00","affected":[{"ecosystem":"Vendor product","name":"Reader","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Readwise\",\n                    \"product\": \"Reader\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"8.7.2\",\n                            \"lessThan\": \"8.10.1\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://kb.cert.org/vuls/id/699627"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-18320","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-18320","identifiers":["CVE-2026-18320"]},"retained":false,"historicalAffected":[]}],"coverage":[]}