CVE-2026-82090: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in getpocket Pocket

This vulnerability (CWE-79) in Pocket versions through 8.33.0.0 allows an attacker to perform cross-site scripting via the 'Save to Pocket' feature, which improperly injects external HTML content into the DOM. The injected JavaScript can alter the application state by leveraging native bridge methods, increasing the impact severity. The CVSS 4.0 base score is 9.2, reflecting critical severity with network attack vector, low attack complexity, and no required privileges or user interaction. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of the Pocket application, potentially altering application state and compromising user security. The vulnerability is exploitable without user interaction or privileges, increasing its risk. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should monitor vendor communications for updates. Avoid using the vulnerable 'Save to Pocket' feature with untrusted content if possible.