Executive brief
The wallabag Android application is a news reader that stores articles for offline reading. The app is vulnerable to cross-site scripting (XSS) because it loads article data from the server directly into a WebView without proper sanitization. An attacker who can modify the article content returned by the server (or intercept the connection) could inject malicious JavaScript code that executes in the context of the app, potentially stealing user data or performing unauthorized actions.
Technical details
The vulnerability is a reflected XSS in the Android WebView component. The /api/entries endpoint returns article data that is loaded directly into a WebView without HTML sanitization or encoding. An attacker can inject arbitrary HTML and JavaScript payloads into articles stored on the wallabag server or intercepted in transit. When the app loads the articles via the /api/entries API, the malicious script executes within the WebView's security context, potentially allowing theft of stored credentials, local data, or performing actions on behalf of the user. No authentication bypass is required—only the ability to modify the article content. Patches or updates are not mentioned in the advisory.
Affected products
- wallabag Android app through 2.6.0
Timeline
- 2026-08-28: disclosed