CVE-2026-18320 Readwise CVE debrief

Who should care

Defenders responsible for Android applications using the Readwise Reader component should assess exposure and prioritize mitigation. This includes reviewing application code, verifying versions, and implementing compensating controls where necessary. Security teams should also monitor for updates from the vendor and plan for swift deployment of patches or mitigations.

Why it matters

CVE-2026-18320 is a client-side cross-site scripting (XSS) vulnerability in Readwise Reader for Android. Defenders should prioritize verifying and mitigating this vulnerability in their Android applications, especially those using the Readwise Reader component. The vulnerability allows an attacker to supply malicious SVG content that executes script when rendered in the Reader WebView. However, there is limited information on affected versions, exploitation, or remediation.

• Potential for client-side cross-site scripting (XSS) attacks
• Possible execution of malicious script in the Reader WebView
• Need for verification of affected versions and remediation

Technical summary

The Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script when rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in their Android applications, especially those using the Readwise Reader component.

Recommended defensive actions

• Verify if the Readwise Reader component is used in your Android applications and assess the version in use.
• Review the sanitize-html configuration to ensure it does not permit all attributes on SVG and PATH elements.
• Implement additional security measures to prevent XSS attacks, such as input validation and output encoding.
• Monitor for any updates or patches from the vendor and plan for their deployment.
• Perform a thorough review of the application's code and dependencies for similar vulnerabilities.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 6.1 and MEDIUM severity. However, there is limited information on affected versions, exploitation, or remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.