CVE-2026-82089CWE-79cross-site-scripting

CVE-2026-82089

published August 28, 2026

CVSS

8.8

EPSS

1%

Percentile

43.7

In the wild

Unconfirmed

What it is

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.

The record

Technical detail

CVSS: 8.8 · NONE
CVSS v4.0: 8.8 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/AU:Y/R:U/V:C/RE:M/U:Green
EPSS: 0.00525 · 43.7th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-08-28T09:16Z

References (6)

https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/data/StorageHelper.java · [email protected]https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/events/EventProcessor.java · [email protected]https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/service/workers/ArticleAsFileDownloader.java · [email protected]https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/service/workers/ArticleUpdater.java · [email protected]https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/ui/ReadArticleActivity.java · [email protected]https://github.com/wallabag/wallabag/security/advisories/GHSA-q2g2-www6-wf5h · [email protected]

EPSS history

Timeline

28 AUG 03:14Z
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView
cvelistv5