Cross-site scripting in wallabag android-app
Priority MEDIUM 41CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00525 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82089
- 2026-10-03 Alias added: GHSA-c6wm-f83x-r49p
References
Other 6
- Affected Source: ReadArticleActivity.java - WebView with JavaScript enabled renders unsanitized HTML content
- Affected Source: ArticleUpdater.java - Article content stored in local database without sanitization
- Affected Source: ArticleAsFileDownloader.java - Binary passthrough of server-generated PDF/ePub containing unsanitized HTML
- Affected Source: StorageHelper.java - Export file written to external shared storage accessible to other applications
- Affected Source: EventProcessor.java - FileProvider ACTION_VIEW handoff of unsanitized exported file to third-party applications
- Related server-side finding: GHSA-q2g2-www6-wf5h (Stored XSS, SSRF, Local File Read in wallabag server)
More wallabag vulnerabilities
- TI-2023-00696 Improper Authorization in wallabag/wallabag CVSS 3.1MEDIUM 5.3
- TI-2026-56644 wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export. CVSS 3.1MEDIUM 6.4
- TI-2023-04113 Cross-Site Request Forgery (CSRF) in wallabag/wallabag CVSS 3.1MEDIUM 6.5
- TI-2023-00699 CSRF in wallabag/wallabag CVSS 3.1MEDIUM 6.5
- TI-2023-04112 Cross-Site Request Forgery (CSRF) in wallabag/wallabag CVSS 3.1MEDIUM 5.7
- TI-2023-00698 Cross-site Scripting (XSS) - Stored in wallabag/wallabag CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-82089 · CVE Program
- CVE-2026-82089 · NVD
- FIRST EPSS
- GHSA-c6wm-f83x-r49p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences