CVE-2026-82642 readest CVE debrief

Who should care

Users of Readest e-book reader versions prior to 0.11.16, as well as administrators and security teams responsible for managing and securing e-book reader software, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes updating to version 0.11.16 or later and restricting usage of untrusted EPUB content. Additionally, security teams should monitor for suspicious activity and review relevant logs for exposed assets that need extra review.

Technical summary

The Readest e-book reader vulnerability CVE-2026-82642 allows for arbitrary code execution via crafted EPUB content due to inadequate sanitization of EPUB chapter HTML. The vulnerability is caused by permitting an attacker to embed a complete HTML document containing a script tag inside an iframe's srcdoc attribute, which can execute when the browser renders the iframe. The content iframe is configured with sandbox='allow-same-origin allow-scripts', enabling script execution with parent origin access and allowing invocation of Tauri IPC commands, thus escalating to arbitrary code execution. Users of Readest e-book reader versions prior to 0.11.16 are affected.

Defensive priority

Users of Readest e-book reader versions prior to 0.11.16 should update to mitigate arbitrary code execution risk via crafted EPUB content.

Recommended defensive actions

• Update Readest e-book reader to version 0.11.16 or later
• Restrict usage of untrusted EPUB content
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-82642 record indicates a high-severity vulnerability in Readest e-book reader versions prior to 0.11.16, allowing for arbitrary code execution via crafted EPUB content. The vulnerability is caused by inadequate sanitization of EPUB chapter HTML, permitting an attacker to embed a complete HTML document containing a script tag inside an iframe's srcdoc attribute, which can execute when the browser renders the iframe. The content iframe is configured with sandbox='allow-same-origin allow-scripts', enabling script execution with parent origin access and allowing invocation of Tauri IPC commands, thus escalating to arbitrary code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.