# CVE-2026-18311: Readwise Reader for Android cross-site scripting in document metadata

Source: https://junglewise.ai/threats/cve-2026-18311-readwise-reader-for-android-contains-a-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18311 · Severity: medium · CVSS 6.1 · Published 2026-09-25

Readwise Reader for Android is a content aggregation and synchronization app that collects articles and documents across devices. The app fails to properly sanitize document metadata (such as author names and titles) before displaying them in web views, allowing attackers to inject malicious scripts. When a user opens a synced document with poisoned metadata, the embedded script executes with access to the app's stored documents, credentials, and session tokens.

Technologies: [Readwise Reader for Android](https://junglewise.ai/threats/technologies/reader-for-android). Vendors: [Readwise](https://junglewise.ai/threats/vendors/readwise).

## Quick answers

**Is CVE-2026-18311 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18311 being exploited in the wild.

**How severe is CVE-2026-18311?** Medium severity, with a CVSS score of 6.1, published 25 September 2026.

**Which products and versions are affected?** Readwise Reader for Android 8.7.2; fixed in 8.10.1.

**Is there a fix for CVE-2026-18311?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18311 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-18311?** Check whether you run Readwise Reader for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Three stored XSS vulnerabilities stem from insufficient HTML escaping in the header rendering component (CVE-2026-18311), WebView URL construction logic (CVE-2026-18312), and SVG sanitization configuration (CVE-2026-18320). Metadata fields and SVG attributes are injected into the DOM via innerHTML without proper sanitization. An attacker who can craft or modify documents in the user's library can inject malicious payloads that execute in the WebView context on all synchronized devices; version 8.10.1 addresses the sanitizer-wildcard issue.

## Affected products

- Readwise Reader for Android 8.7.2; fixed in 8.10.1

## Timeline

- 2026-09-25: disclosed

## References

- [https://kb.cert.org/vuls/id/699627](https://kb.cert.org/vuls/id/699627)

## Related threats

- [Readwise Reader for Android XSS in SVG sanitization](https://junglewise.ai/threats/cve-2026-18320-readwise-reader-for-android-uses-a-sanitize-html-configuration)
- [Readwise Reader for Android stored XSS in WebView URL construction](https://junglewise.ai/threats/cve-2026-18312-readwise-reader-for-android-constructs-urls-in-its-webview-using)