Readest is an open-source e-book reader built on Tauri. (CVE-2026-82642)

Readest versions before 0.11.16 use DOMPurify to sanitize EPUB chapter HTML but only forbid the <script> tag. DOMPurify does not parse the srcdoc attribute of <iframe> elements, allowing an attacker to embed a complete HTML document with scripts inside srcdoc. The iframe sandbox configuration permits scripts to run with the same origin, enabling access to Tauri's internal IPC commands and resulting in arbitrary code execution. The exploit can be hidden via zero-size, transparent iframes. The vulnerability is fixed in version 0.11.16 by adding 'iframe', 'object', and 'embed' to forbidden tags and 'srcdoc' to forbidden attributes in the sanitizer.

An attacker who can inject crafted EPUB content can execute arbitrary code within the Readest application context by bypassing sanitization and leveraging Tauri IPC commands. This leads to full compromise of the application with high confidentiality, integrity, and availability impact. The exploit can be stealthy, as the malicious iframe can be invisible to the user.

Upgrade Readest to version 0.11.16 or later, which includes hardened sanitizer configurations that forbid iframe, object, embed tags and the srcdoc attribute, effectively mitigating this vulnerability. No additional mitigation is required if the application is updated.