Three stored XSS vulnerabilities (CVE-2026-18311, CVE-2026-18312, CVE-2026-18320) affect Readwise Reader for Android version 8.7.2. CVE-2026-18311 involves insufficient HTML escaping in header rendering metadata fields like 'doc.author' and 'doc.title', allowing script injection in synchronized documents. CVE-2026-18312 concerns improper escaping of URL metadata used in WebView URL construction for X video fallback and iOS paywall messages, enabling script injection via href attributes. CVE-2026-18320 results from a wildcard attribute rule in the sanitize-html configuration permitting script-capable attributes such as onload and onerror on SVG and PATH elements, allowing malicious SVG markup to execute scripts. These vulnerabilities enable attackers who can craft or modify documents accessible to the app to execute arbitrary JavaScript in the WebView context, potentially compromising user data. The vendor was not reachable for coordination, but version 8.10.1 includes a patch for the sanitizer wildcard issue.

Successful exploitation allows remote attackers to execute arbitrary JavaScript within the Readwise Reader Android app's WebView context by supplying malicious document metadata or SVG markup. This can compromise the confidentiality and integrity of user data, including stored documents, credentials, and session tokens. The vulnerabilities are stored XSS, meaning malicious scripts persist in user libraries and synchronize across devices, increasing exposure risk.

Users should update Readwise Reader for Android to version 8.10.1 or later, which includes a patch addressing the sanitizer wildcard issue (CVE-2026-18320). Since the vendor could not be reached for coordinated disclosure, users should monitor for further vendor updates that address all identified vulnerabilities. Additionally, users should exercise caution when adding content from untrusted sources and manually review document metadata before saving articles to reduce exposure to malicious content.