Executive brief
Repetico is a mobile learning app that allows users to create and share flashcard sets. A vulnerability allows an authenticated user to inject malicious JavaScript code into flashcard questions, which is stored and automatically executed when other users view those cards—including through publicly shared sets. An attacker could steal sensitive data or manipulate content visible to other app users.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Repetico Android app v1.9.7.31. An authenticated user can inject arbitrary JavaScript through the question text field of a multiple-choice flashcard; the payload persists server-side and executes in the app's WebView context when any user renders that card. The vulnerability arises from insufficient output encoding and lack of server-side sanitization of user-supplied flashcard content. Attack requires user authentication and victim interaction (opening the affected flashcard set), but the impact affects all users who access the set. JavaScript execution allows reading application data, content spoofing, and potential exploitation of WebView-to-native bridges. No patch is publicly available as of the advisory date.
Affected products
- Repetico Repetico 1.9.7.31
Timeline
- 2025-10-06: disclosed: Vulnerability discovered; vendor contacted
- 2025-11-11: advisory: CVE-2025-63842 assigned by MITRE
- 2026-06-30: other: Public disclosure