CVE-2026-82089: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wallabag android-app
Description
CVE-2026-82089 is a high-severity cross-site scripting (XSS) vulnerability in the wallabag Android application up to version 2.6.0. The vulnerability arises because data from the /api/entries endpoint is loaded into a WebView without proper input neutralization, allowing malicious scripts to execute. This flaw can lead to significant confidentiality and integrity impacts if exploited. No official patch or remediation guidance is currently available from the vendor. The vulnerability requires user interaction and some privileges but can be exploited remotely over the network.
CVSS v4.0
Score 8.8high
Affected software
wallabag
android-app
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The wallabag Android application (fr.gaulupeau.apps.InThePoche) through version 2.6.0 is affected by a CWE-79 improper neutralization of input during web page generation vulnerability. Specifically, data retrieved from the /api/entries endpoint is loaded into a WebView component without adequate sanitization, enabling cross-site scripting (XSS) attacks. This vulnerability has a CVSS 4.0 base score of 8.8, indicating high severity, with network attack vector, low attack complexity, partial privileges required, user interaction needed, and high impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published as of the data provided.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts within the context of the wallabag Android app's WebView. This can lead to unauthorized disclosure of sensitive information, modification of app data, and potential disruption of app functionality. The CVSS vector indicates high impact on confidentiality, integrity, and availability, with user interaction required and partial privileges needed.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content within the app. No vendor-provided mitigation or temporary fix is currently documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-08-28T03:14:19.799Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9117a1acd9273b496fd5af
Added to database: 08/28/2026, 05:07:45 UTC
Last enriched: 09/08/2026, 10:07:10 UTC
Last updated: 10/12/2026, 18:48:23 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.