CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).

• CWE-79

• https://kb.cert.org/vuls/id/699627

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18312Readwise Reader for Android constructs URLs in its WebView u…6.1
• CVE-2026-18313rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPD…4.3
• CVE-2026-18315The TrueBooker – Appointment Booking and Scheduler System pl…9.8
• CVE-2026-18316The Solace Extra plugin for WordPress is vulnerable to unaut…9.1
• CVE-2026-18317The Foxtool All-in-One: Contact chat button, Custom login, M…4.3
• CVE-2026-1832The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge…4.3
• CVE-2026-18321Buffer overflow in NTPsec's Zyfer refclock allows local atta…4.7
• CVE-2026-18322The Smart Popup by Supsystic plugin for WordPress is vulnera…8.8
• CVE-2026-18323The Forminator Forms – Contact Form, Payment Form & Custom F…7.2
• CVE-2026-18324The Forminator Forms – Contact Form, Payment Form & Custom F…7.2
• CVE-2026-18325The Forminator Forms – Contact Form, Payment Form & Custom F…7.2
• CVE-2026-18328The Forminator Forms – Contact Form, Payment Form & Custom F…7.2