Executive brief
Readest is an open-source e-book reader that sanitizes EPUB content before displaying it. A flaw in the sanitizer allowed malicious EPUB files to embed hidden iframes with executable scripts that bypass security checks and gain full access to the application's code execution capabilities. An attacker can craft a malicious e-book that executes arbitrary code when opened, potentially compromising the reader's system.
Technical details
The vulnerability is an HTML sanitization bypass in Readest's EPUB processing. The DOMPurify sanitizer was configured to forbid only the <script> tag, but DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string. An attacker can craft an EPUB with an <iframe srcdoc="<html><script>..."> payload that survives sanitization. When rendered, the iframe (configured with sandbox="allow-same-origin allow-scripts") executes the embedded script with access to parent.parent.__TAURI_INTERNALS__.invoke(), allowing invocation of any Tauri IPC command the application permits. The payload can be made invisible through zero-size or transparent attributes. The fix in version 0.11.16 adds 'iframe', 'object', 'embed' to FORBID_TAGS and 'srcdoc' to FORBID_ATTR.
Affected products
- Readest Readest prior to 0.11.16
Timeline
- 2026-08-30: disclosed