Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-18312
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 17 hours ago Activity log
  • Created suggestion 17 hours ago
CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content, enabling stored cross-site scripting (XSS)

Affected products

Reader
  • =<8.10.1

Matching in nixpkgs

pkgs.reader

Lightweight tool offering better readability of web pages on the CLI

  • nixos-unstable -
    • nixos-unstable-small 0.6.0
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.xreader

Document viewer capable of displaying multiple and single page document formats like PDF and Postscript

  • nixos-unstable -
    • nixos-unstable-small 4.6.7
  • nixos-26.05 -
    • nixos-26.05-small 4.6.5

pkgs.koreader

Ebook reader application supporting PDF, DjVu, EPUB, FB2 and many more formats, running on Cervantes, Kindle, Kobo, PocketBook and Android devices

  • nixos-unstable -
  • nixos-26.05 -

pkgs.yacreader

Comic reader for cross-platform reading and managing your digital comic collection

  • nixos-unstable -
  • nixos-26.05 -

pkgs.coolreader

Cross platform open source e-book reader

  • nixos-unstable -
  • nixos-26.05 -

pkgs.rfc-reader

RFC viewer with TUI

  • nixos-unstable -
  • nixos-26.05 -

pkgs.ubi_reader

Python scripts capable of extracting and analyzing the contents of UBI and UBIFS images

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mangareader

Qt manga reader for local files

  • nixos-unstable -
    • nixos-unstable-small 2.5.1
  • nixos-26.05 -
    • nixos-26.05-small 2.5.0

pkgs.guile-reader

Simple framework for building readers for GNU Guile

  • nixos-unstable -
    • nixos-unstable-small 0.6.3
  • nixos-26.05 -
    • nixos-26.05-small 0.6.3

pkgs.koodo-reader

Cross-platform ebook reader

  • nixos-unstable -
    • nixos-unstable-small 2.3.4
  • nixos-26.05 -
    • nixos-26.05-small 2.3.4

pkgs.raven-reader

Open source desktop news reader with flexible settings to optimize your experience

  • nixos-unstable -
  • nixos-26.05 -

pkgs.fluent-reader

Modern desktop RSS reader built with Electron, React, and Fluent UI

  • nixos-unstable -
    • nixos-unstable-small 1.2.2
  • nixos-26.05 -
    • nixos-26.05-small 1.2.2

pkgs.haskellPackages.hreader

Generalization of MonadReader and ReaderT using hset

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

Package maintainers