Search
Find a vulnerability
Search criteria
10 vulnerabilities by readest
CVE-2026-57567 (GCVE-0-2026-57567)
Vulnerability from nvd – Published: 2026-11-04 21:43 – Updated: 2026-11-04 21:43
VLAI
EPSS
VEX
Title
Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Summary
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.
Severity
8.6 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | x_refsource_CONFIRM |
| https://github.com/readest/readest/pull/4639 | x_refsource_MISC |
| https://github.com/readest/readest/pull/4651 | x_refsource_MISC |
| https://github.com/readest/readest/commit/4025c4d… | x_refsource_MISC |
| https://github.com/readest/readest/commit/446c2c7… | x_refsource_MISC |
| https://github.com/readest/readest/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "readest",
"vendor": "readest",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:43:03.981Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg"
},
{
"name": "https://github.com/readest/readest/pull/4639",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4639"
},
{
"name": "https://github.com/readest/readest/pull/4651",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4651"
},
{
"name": "https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604"
},
{
"name": "https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15"
},
{
"name": "https://github.com/readest/readest/releases/tag/v0.11.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.10"
}
],
"source": {
"advisory": "GHSA-55vr-pvq5-6fmg",
"discovery": "UNKNOWN"
},
"title": "Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57567",
"datePublished": "2026-11-04T21:43:03.981Z",
"dateReserved": "2026-06-24T18:49:56.207Z",
"dateUpdated": "2026-11-04T21:43:03.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57566 (GCVE-0-2026-57566)
Vulnerability from nvd – Published: 2026-11-04 21:44 – Updated: 2026-11-04 21:44
VLAI
EPSS
VEX
Title
Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
Summary
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.
Severity
9.3 (Critical)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | x_refsource_CONFIRM |
| https://github.com/readest/readest/pull/4638 | x_refsource_MISC |
| https://github.com/readest/readest/commit/495783d… | x_refsource_MISC |
| https://github.com/readest/readest/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "readest",
"vendor": "readest",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:44:27.349Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx"
},
{
"name": "https://github.com/readest/readest/pull/4638",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4638"
},
{
"name": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"
},
{
"name": "https://github.com/readest/readest/releases/tag/v0.11.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.10"
}
],
"source": {
"advisory": "GHSA-c7mm-g2j2-98cx",
"discovery": "UNKNOWN"
},
"title": "Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57566",
"datePublished": "2026-11-04T21:44:27.349Z",
"dateReserved": "2026-06-24T18:49:56.206Z",
"dateUpdated": "2026-11-04T21:44:27.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57565 (GCVE-0-2026-57565)
Vulnerability from nvd – Published: 2026-11-04 21:45 – Updated: 2026-11-04 21:45
VLAI
EPSS
VEX
Title
Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Summary
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.
Severity
6.5 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | x_refsource_CONFIRM |
| https://github.com/readest/readest/pull/4638 | x_refsource_MISC |
| https://github.com/readest/readest/commit/495783d… | x_refsource_MISC |
| https://github.com/readest/readest/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "readest",
"vendor": "readest",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user\u0027s identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller\u0027s namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user\u0027s stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:45:21.130Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw"
},
{
"name": "https://github.com/readest/readest/pull/4638",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4638"
},
{
"name": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"
},
{
"name": "https://github.com/readest/readest/releases/tag/v0.11.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.10"
}
],
"source": {
"advisory": "GHSA-mfmj-2frf-vhgw",
"discovery": "UNKNOWN"
},
"title": "Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57565",
"datePublished": "2026-11-04T21:45:21.130Z",
"dateReserved": "2026-06-24T18:49:56.206Z",
"dateUpdated": "2026-11-04T21:45:21.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57562 (GCVE-0-2026-57562)
Vulnerability from nvd – Published: 2026-11-04 21:46 – Updated: 2026-11-04 21:46
VLAI
EPSS
VEX
Title
Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
Summary
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.
Severity
6.5 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | x_refsource_CONFIRM |
| https://github.com/readest/readest/pull/4638 | x_refsource_MISC |
| https://github.com/readest/readest/commit/495783d… | x_refsource_MISC |
| https://github.com/readest/readest/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "readest",
"vendor": "readest",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller\u0027s user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user\u0027s own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:46:13.389Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8"
},
{
"name": "https://github.com/readest/readest/pull/4638",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4638"
},
{
"name": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"
},
{
"name": "https://github.com/readest/readest/releases/tag/v0.11.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.10"
}
],
"source": {
"advisory": "GHSA-pv88-3727-j7v8",
"discovery": "UNKNOWN"
},
"title": "Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57562",
"datePublished": "2026-11-04T21:46:13.389Z",
"dateReserved": "2026-06-24T18:49:56.206Z",
"dateUpdated": "2026-11-04T21:46:13.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82642 (GCVE-0-2026-82642)
Vulnerability from nvd – Published: 2026-08-30 13:44 – Updated: 2026-08-31 16:45
VLAI
EPSS
VEX
Title
Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution
Summary
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | vendor-advisory |
| https://github.com/readest/readest/pull/4762 | patch |
| https://github.com/readest/readest/commit/005aa2d… | patch |
| https://github.com/readest/readest/releases/tag/v… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82642",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:45:50.271180Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:45:59.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/readest/readest",
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "readest",
"repo": "https://github.com/readest/readest",
"vendor": "readest",
"versions": [
{
"lessThan": "0.11.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick, JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReadest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the \u0026lt;script\u0026gt; tag (FORBID_TAGS: [\u0027script\u0027]) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on \u0026lt;iframe\u0026gt; elements, treating it as an opaque string attribute, so an attacker who can get an \u0026lt;iframe\u0026gt; element to survive sanitization can embed a complete HTML document containing a \u0026lt;script\u0026gt; tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding \u0027iframe\u0027, \u0027object\u0027 and \u0027embed\u0027 to FORBID_TAGS and adding \u0027srcdoc\u0027 to FORBID_ATTR.\u003c/p\u003e"
}
],
"value": "Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the \u003cscript\u003e tag (FORBID_TAGS: [\u0027script\u0027]) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on \u003ciframe\u003e elements, treating it as an opaque string attribute, so an attacker who can get an \u003ciframe\u003e element to survive sanitization can embed a complete HTML document containing a \u003cscript\u003e tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding \u0027iframe\u0027, \u0027object\u0027 and \u0027embed\u0027 to FORBID_TAGS and adding \u0027srcdoc\u0027 to FORBID_ATTR."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T13:44:34.109Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-p4x7-pf2c-xrvj",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj"
},
{
"name": "PR #4762",
"tags": [
"patch"
],
"url": "https://github.com/readest/readest/pull/4762"
},
{
"name": "Fix commit 005aa2d6157a",
"tags": [
"patch"
],
"url": "https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb"
},
{
"name": "Release v0.11.16 (first fixed release)",
"tags": [
"release-notes"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.16"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Readest 0.11.16 or later. The fix adds \u0027srcdoc\u0027 to the DOMPurify FORBID_ATTR list and \u0027iframe\u0027, \u0027object\u0027 and \u0027embed\u0027 to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.\u003c/p\u003e"
}
],
"value": "Upgrade to Readest 0.11.16 or later. The fix adds \u0027srcdoc\u0027 to the DOMPurify FORBID_ATTR list and \u0027iframe\u0027, \u0027object\u0027 and \u0027embed\u0027 to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-23T00:00:00.000Z",
"value": "Reported to the Readest maintainers"
},
{
"lang": "en",
"time": "2026-06-24T14:01:00.000Z",
"value": "Fix committed (005aa2d6157a, PR #4762)"
},
{
"lang": "en",
"time": "2026-06-28T18:51:00.000Z",
"value": "Fix released in v0.11.16"
}
],
"title": "Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly open EPUB files from trusted sources. Ensure the \u0027allow script\u0027 view setting remains disabled, as enabling it bypasses sanitization entirely.\u003c/p\u003e"
}
],
"value": "Only open EPUB files from trusted sources. Ensure the \u0027allow script\u0027 view setting remains disabled, as enabling it bypasses sanitization entirely."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-82642",
"datePublished": "2026-08-30T13:44:34.109Z",
"dateReserved": "2026-08-30T13:32:39.506Z",
"dateUpdated": "2026-08-31T16:45:59.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57562 (GCVE-0-2026-57562)
Vulnerability from cvelistv5 – Published: 2026-11-04 21:46 – Updated: 2026-11-04 21:46
VLAI
EPSS
VEX
Title
Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
Summary
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.
Severity
6.5 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | x_refsource_CONFIRM |
| https://github.com/readest/readest/pull/4638 | x_refsource_MISC |
| https://github.com/readest/readest/commit/495783d… | x_refsource_MISC |
| https://github.com/readest/readest/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "readest",
"vendor": "readest",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller\u0027s user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user\u0027s own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:46:13.389Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8"
},
{
"name": "https://github.com/readest/readest/pull/4638",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4638"
},
{
"name": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"
},
{
"name": "https://github.com/readest/readest/releases/tag/v0.11.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.10"
}
],
"source": {
"advisory": "GHSA-pv88-3727-j7v8",
"discovery": "UNKNOWN"
},
"title": "Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57562",
"datePublished": "2026-11-04T21:46:13.389Z",
"dateReserved": "2026-06-24T18:49:56.206Z",
"dateUpdated": "2026-11-04T21:46:13.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57565 (GCVE-0-2026-57565)
Vulnerability from cvelistv5 – Published: 2026-11-04 21:45 – Updated: 2026-11-04 21:45
VLAI
EPSS
VEX
Title
Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Summary
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.
Severity
6.5 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | x_refsource_CONFIRM |
| https://github.com/readest/readest/pull/4638 | x_refsource_MISC |
| https://github.com/readest/readest/commit/495783d… | x_refsource_MISC |
| https://github.com/readest/readest/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "readest",
"vendor": "readest",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user\u0027s identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller\u0027s namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user\u0027s stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:45:21.130Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw"
},
{
"name": "https://github.com/readest/readest/pull/4638",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4638"
},
{
"name": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"
},
{
"name": "https://github.com/readest/readest/releases/tag/v0.11.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.10"
}
],
"source": {
"advisory": "GHSA-mfmj-2frf-vhgw",
"discovery": "UNKNOWN"
},
"title": "Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57565",
"datePublished": "2026-11-04T21:45:21.130Z",
"dateReserved": "2026-06-24T18:49:56.206Z",
"dateUpdated": "2026-11-04T21:45:21.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57566 (GCVE-0-2026-57566)
Vulnerability from cvelistv5 – Published: 2026-11-04 21:44 – Updated: 2026-11-04 21:44
VLAI
EPSS
VEX
Title
Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
Summary
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.
Severity
9.3 (Critical)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | x_refsource_CONFIRM |
| https://github.com/readest/readest/pull/4638 | x_refsource_MISC |
| https://github.com/readest/readest/commit/495783d… | x_refsource_MISC |
| https://github.com/readest/readest/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "readest",
"vendor": "readest",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:44:27.349Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx"
},
{
"name": "https://github.com/readest/readest/pull/4638",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4638"
},
{
"name": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"
},
{
"name": "https://github.com/readest/readest/releases/tag/v0.11.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.10"
}
],
"source": {
"advisory": "GHSA-c7mm-g2j2-98cx",
"discovery": "UNKNOWN"
},
"title": "Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57566",
"datePublished": "2026-11-04T21:44:27.349Z",
"dateReserved": "2026-06-24T18:49:56.206Z",
"dateUpdated": "2026-11-04T21:44:27.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57567 (GCVE-0-2026-57567)
Vulnerability from cvelistv5 – Published: 2026-11-04 21:43 – Updated: 2026-11-04 21:43
VLAI
EPSS
VEX
Title
Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Summary
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.
Severity
8.6 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | x_refsource_CONFIRM |
| https://github.com/readest/readest/pull/4639 | x_refsource_MISC |
| https://github.com/readest/readest/pull/4651 | x_refsource_MISC |
| https://github.com/readest/readest/commit/4025c4d… | x_refsource_MISC |
| https://github.com/readest/readest/commit/446c2c7… | x_refsource_MISC |
| https://github.com/readest/readest/releases/tag/v… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "readest",
"vendor": "readest",
"versions": [
{
"status": "affected",
"version": "\u003c 0.11.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:43:03.981Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg"
},
{
"name": "https://github.com/readest/readest/pull/4639",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4639"
},
{
"name": "https://github.com/readest/readest/pull/4651",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/pull/4651"
},
{
"name": "https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604"
},
{
"name": "https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15"
},
{
"name": "https://github.com/readest/readest/releases/tag/v0.11.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.10"
}
],
"source": {
"advisory": "GHSA-55vr-pvq5-6fmg",
"discovery": "UNKNOWN"
},
"title": "Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57567",
"datePublished": "2026-11-04T21:43:03.981Z",
"dateReserved": "2026-06-24T18:49:56.207Z",
"dateUpdated": "2026-11-04T21:43:03.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82642 (GCVE-0-2026-82642)
Vulnerability from cvelistv5 – Published: 2026-08-30 13:44 – Updated: 2026-08-31 16:45
VLAI
EPSS
VEX
Title
Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution
Summary
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/readest/readest/security/advis… | vendor-advisory |
| https://github.com/readest/readest/pull/4762 | patch |
| https://github.com/readest/readest/commit/005aa2d… | patch |
| https://github.com/readest/readest/releases/tag/v… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82642",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:45:50.271180Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:45:59.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/readest/readest",
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "readest",
"repo": "https://github.com/readest/readest",
"vendor": "readest",
"versions": [
{
"lessThan": "0.11.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick, JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReadest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the \u0026lt;script\u0026gt; tag (FORBID_TAGS: [\u0027script\u0027]) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on \u0026lt;iframe\u0026gt; elements, treating it as an opaque string attribute, so an attacker who can get an \u0026lt;iframe\u0026gt; element to survive sanitization can embed a complete HTML document containing a \u0026lt;script\u0026gt; tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding \u0027iframe\u0027, \u0027object\u0027 and \u0027embed\u0027 to FORBID_TAGS and adding \u0027srcdoc\u0027 to FORBID_ATTR.\u003c/p\u003e"
}
],
"value": "Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the \u003cscript\u003e tag (FORBID_TAGS: [\u0027script\u0027]) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on \u003ciframe\u003e elements, treating it as an opaque string attribute, so an attacker who can get an \u003ciframe\u003e element to survive sanitization can embed a complete HTML document containing a \u003cscript\u003e tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox=\"allow-same-origin allow-scripts\", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding \u0027iframe\u0027, \u0027object\u0027 and \u0027embed\u0027 to FORBID_TAGS and adding \u0027srcdoc\u0027 to FORBID_ATTR."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T13:44:34.109Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-p4x7-pf2c-xrvj",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj"
},
{
"name": "PR #4762",
"tags": [
"patch"
],
"url": "https://github.com/readest/readest/pull/4762"
},
{
"name": "Fix commit 005aa2d6157a",
"tags": [
"patch"
],
"url": "https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb"
},
{
"name": "Release v0.11.16 (first fixed release)",
"tags": [
"release-notes"
],
"url": "https://github.com/readest/readest/releases/tag/v0.11.16"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Readest 0.11.16 or later. The fix adds \u0027srcdoc\u0027 to the DOMPurify FORBID_ATTR list and \u0027iframe\u0027, \u0027object\u0027 and \u0027embed\u0027 to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts.\u003c/p\u003e"
}
],
"value": "Upgrade to Readest 0.11.16 or later. The fix adds \u0027srcdoc\u0027 to the DOMPurify FORBID_ATTR list and \u0027iframe\u0027, \u0027object\u0027 and \u0027embed\u0027 to FORBID_TAGS in apps/readest-app/src/services/transformers/sanitizer.ts."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-23T00:00:00.000Z",
"value": "Reported to the Readest maintainers"
},
{
"lang": "en",
"time": "2026-06-24T14:01:00.000Z",
"value": "Fix committed (005aa2d6157a, PR #4762)"
},
{
"lang": "en",
"time": "2026-06-28T18:51:00.000Z",
"value": "Fix released in v0.11.16"
}
],
"title": "Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly open EPUB files from trusted sources. Ensure the \u0027allow script\u0027 view setting remains disabled, as enabling it bypasses sanitization entirely.\u003c/p\u003e"
}
],
"value": "Only open EPUB files from trusted sources. Ensure the \u0027allow script\u0027 view setting remains disabled, as enabling it bypasses sanitization entirely."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-82642",
"datePublished": "2026-08-30T13:44:34.109Z",
"dateReserved": "2026-08-30T13:32:39.506Z",
"dateUpdated": "2026-08-31T16:45:59.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}