Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-18320
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 1 day, 16 hours ago Activity log
  • Created suggestion 1 day, 16 hours ago
CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).

Affected products

Reader
  • <8.10.1

Matching in nixpkgs

pkgs.reader

Lightweight tool offering better readability of web pages on the CLI

  • nixos-unstable -
    • nixos-unstable-small 0.6.0
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.xreader

Document viewer capable of displaying multiple and single page document formats like PDF and Postscript

  • nixos-unstable -
    • nixos-unstable-small 4.6.7
  • nixos-26.05 -
    • nixos-26.05-small 4.6.5

pkgs.koreader

Ebook reader application supporting PDF, DjVu, EPUB, FB2 and many more formats, running on Cervantes, Kindle, Kobo, PocketBook and Android devices

  • nixos-unstable -
  • nixos-26.05 -

pkgs.yacreader

Comic reader for cross-platform reading and managing your digital comic collection

  • nixos-unstable -
  • nixos-26.05 -

pkgs.coolreader

Cross platform open source e-book reader

  • nixos-unstable -
  • nixos-26.05 -

pkgs.rfc-reader

RFC viewer with TUI

  • nixos-unstable -
  • nixos-26.05 -

pkgs.ubi_reader

Python scripts capable of extracting and analyzing the contents of UBI and UBIFS images

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mangareader

Qt manga reader for local files

  • nixos-unstable -
    • nixos-unstable-small 2.5.1
  • nixos-26.05 -
    • nixos-26.05-small 2.5.0

pkgs.guile-reader

Simple framework for building readers for GNU Guile

  • nixos-unstable -
    • nixos-unstable-small 0.6.3
  • nixos-26.05 -
    • nixos-26.05-small 0.6.3

pkgs.koodo-reader

Cross-platform ebook reader

  • nixos-unstable -
    • nixos-unstable-small 2.3.4
  • nixos-26.05 -
    • nixos-26.05-small 2.3.4

pkgs.raven-reader

Open source desktop news reader with flexible settings to optimize your experience

  • nixos-unstable -
  • nixos-26.05 -

pkgs.fluent-reader

Modern desktop RSS reader built with Electron, React, and Fluent UI

  • nixos-unstable -
    • nixos-unstable-small 1.2.2
  • nixos-26.05 -
    • nixos-26.05-small 1.2.2

pkgs.haskellPackages.hreader

Generalization of MonadReader and ReaderT using hset

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

Package maintainers