CVE-2026-82089

Executive Summary

CVE-2026-82089 is a cross-site scripting (XSS) vulnerability in the wallabag Android application (fr.gaulupeau.apps.InThePoche) up to and including version 2.6.0. The flaw exists because data retrieved from the /api/entries endpoint is rendered inside a WebView component without proper sanitization or context isolation, allowing maliciously crafted content to execute JavaScript within the application's WebView context.

The vulnerability affects all wallabag Android users who sync or view articles through the application. Successful exploitation could lead to theft of session tokens, unauthorized access to the user's wallabag account, and potentially broader device compromise if the WebView has elevated privileges or JavaScript-to-native bridge interfaces enabled. No patch is currently available, and the vendor has not released an advisory addressing this issue.

Technical Analysis

The vulnerable component is the wallabag Android application, distributed under the package identifier fr.gaulupeau.apps.InThePoche. The application integrates with the wallabag self-hosted read-it-later service, synchronizing article content via the REST API.

The core vulnerability stems from the application's handling of API responses in a WebView. Specifically, JSON data returned by the /api/entries endpoint is loaded into a WebView for rendering. The NVD description states that the XSS is possible "because /api/entries data is loaded into a WebView." This indicates a failure to apply proper output encoding or sanitization to the content before rendering it in the WebView's HTML context.

The attack mechanism is as follows:

1. An attacker controls content that appears in a wallabag entry (e.g., by submitting a malicious article URL to the wallabag service, or by compromising a server that the victim's wallabag instance fetches content from).

2. The victim's wallabag Android application synchronizes with the wallabag server, retrieving entry metadata and content via the /api/entries endpoint.

3. The application loads this data into a WebView without first sanitizing embedded HTML or JavaScript. A crafted HTML payload inside the article content or title would be interpreted by the WebView as executable script.

4. The injected JavaScript executes within the WebView context, which typically shares cookies, session tokens, and potentially bridges to native Android functionality.

The vulnerability class is CWE-79 (Cross-Site Scripting), specifically the "Improper Neutralization of Input During Web Page Generation" variant. The distinguishing factor here is that the XSS occurs within a native application's WebView rather than a traditional browser, which can amplify impact if the WebView configuration allows Java/JavaScript interface bridging.

No information is available regarding the exact code path, function names, or WebView configuration flags (e.g., whether setJavaScriptEnabled(true) is called, or whether addJavascriptInterface() exposes native methods). Insufficient technical detail is available to describe the precise implementation.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-82089. The attack chain described below is inferred from the vulnerability class and the information in the NVD description. Attack steps should be read as class-level analysis, not specific implementation details.

Step 1 — Reconnaissance / Target Identification: An attacker targets a wallabag user who runs the Android application version 2.6.0 or earlier. The attacker may identify victims through public wallabag instances, forums, or social media where users mention wallabag usage. Alternatively, the attacker could target a broader population by injecting malicious content into a web page that is likely to be saved into wallabag (e.g., a blog post, news article, or forum thread with user-supplied HTML).

Step 2 — Triggering the Flaw: The attacker crafts a malicious article containing an XSS payload (e.g., <script>, <img onerror>, or <svg onload> tags containing JavaScript). When the victim saves this article to their wallabag account — or when the victim's wallabag instance fetches content from an attacker-controlled feed — the malicious content enters the wallabag database. When the victim opens the article in the Android app, the app loads the entry data from /api/entries into the WebView. Because the content is not sanitized, the browser engine parses the embedded tags and executes the JavaScript.

Step 3 — Payload Execution: The payload executes in the WebView's JavaScript context. Depending on the WebView configuration, the attacker's script may be able to:

• Read and exfiltrate cookies or session tokens associated with the wallabag domain.
• Make authenticated API requests to the wallabag server on the victim's behalf (e.g., delete entries, modify settings, export data).
• If the application exposes a JavaScript bridge to native Android APIs, the payload may escalate to reading local files, accessing the device's storage, or invoking other privileged operations.

Step 4 — Post-Exploitation Impact: The attacker obtains the victim's wallabag session credentials, allowing persistent unauthorized access to the victim's reading list, notes, and any linked accounts. In a worst-case scenario, if the WebView has access to native device functions, the attacker could install further malware, exfiltrate personal data, or pivot to other applications on the device.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Business Impact: For individual users, the primary impact is compromise of their wallabag account and potentially their mobile device. For organizations that deploy wallabag as an internal knowledge-sharing or content-collection tool, the impact scales: an attacker who compromises one user's session may access internal articles, notes, and annotations, which could contain sensitive business information.

Affected Systems: All Android devices running wallabag (fr.gaulupeau.apps.InThePoche) version 2.6.0 or earlier. The server-side wallabag application itself is not directly vulnerable, but the server is a vector for delivering malicious content to the Android app.

Blast Radius: The attack requires the victim to save a malicious article to their wallabag account. This creates a social-engineering dependency: the attacker either needs to lure the victim to save a specific URL or into subscribing to an attacker-controlled feed. However, because the payload persists in the wallabag database, the attacker does not need to maintain a live malicious server after the content is ingested.

CVSS Context: No CVSS score has been assigned (N/A). Based on the vulnerability class and the Android WebView attack surface, the severity is likely moderate to high. The lack of a CVSS score from the CNA leaves a gap in automated risk scoring; organizations should manually apply compensating controls.

EPSS: Not yet scored by FIRST.org; exploit likelihood has not been modeled by the community.

Detection Guidance

The following detection rules target the traffic and artifacts associated with this vulnerability. They are designed for environments where wallabag Android application traffic is visible to monitoring and where threat hunting is performed.

Sigma Rule

title: Wallabag Android XSS Exploitation Attempt
id: 8d4b2f6e-1c3a-4e7b-9a2d-5c8f0b1e3a44
status: experimental
description: Detects attempts to exploit CVE-2026-82089 by identifying HTTP responses from wallabag API containing script tags or event handler attributes in entry content.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82089
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: proxy
    product: generic
detection:
    selection:
        http.url|contains: /api/entries
        http.response.body|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate article content that includes HTML code examples
level: high

YARA Rule

rule CVE_2026_82089_Wallabag_WebView_XSS
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payload patterns targeting wallabag Android WebView XSS vulnerability"
        cve = "CVE-2026-82089"
        date = "2026-01-01"
    strings:
        $api = "/api/entries"
        $xss1 = "<script>"
        $xss2 = "onerror="
        $xss3 = "onload="
        $xss4 = "javascript:"
        $xss5 = "<img"
        $xss6 = "<svg"
    condition:
        (uint16(0) == 0x0B8E or uint16(0) == 0x0B8B) and  // Android package / dex file magic
        any of ($xss*) and $api
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82089 Wallabag Android XSS in API Response"; flow:established,to_client; http.uri; content:"/api/entries"; http.response_body; content:"<script>"; sid:58208901; rev:1; metadata:former_category EXPLOIT-KIT; reference:cve,2026-82089; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5m
  [network where event.action == "connection_established" and destination.port == 443]
  [http where
    url.path contains "/api/entries" and
    response.status_code == 200 and
    response.body contains ("<script>", "onerror=", "onload=", "javascript:")]

Splunk SPL Query

index=proxy OR index=web
| where url LIKE "%/api/entries%"
| search response_body="*<script>*" OR response_body="*onerror=*" OR response_body="*onload=*" OR response_body="*javascript:*"
| stats count by src_ip, dest_ip, url, user_agent
| table src_ip, dest_ip, url, user_agent, count

Wazuh OSSEC Rule

<group name="web, attack, exploit, cve-2026-82089,">
  <rule id="582089" level="10">
    <decoded>HTTP request</decoded>
    <match>/api/entries</match>
    <regex><script>|onerror=|onload=|javascript:</regex>
    <description>CVE-2026-82089 Wallabag Android XSS - suspicious content in API response</description>
    <group>cve-2026-82089,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch, fix, or vendor advisory has been identified from any tracked source for CVE-2026-82089. The wallabag Android application through version 2.6.0 is affected, and no patched build is available.

1. Immediate Mitigations:

• Disable or restrict JavaScript execution: If the application provides a setting to disable JavaScript in the WebView, enable it immediately. This prevents script execution regardless of content.
• Avoid saving untrusted URLs: Instruct users to refrain from saving articles from unknown or untrusted sources into wallabag until a patch is available.
• Use a dedicated device profile: For enterprise deployments, isolate wallabag usage on devices with managed profiles that restrict app permissions and network access.
• Monitor API traffic: Apply the detection rules above to alert on suspicious content in /api/entries responses.

2. Patch / Upgrade Steps:

• Monitor vendor channels: Check the wallabag GitHub repository and official website for the Android app release notes. A patched version (2.6.1 or later) may be released at any time; deploy it as soon as it is available.
• Version pinning: If using a mobile device management (MDM) solution, enforce a policy that blocks installation of wallabag versions below the patched release once available.
• Contact vendor: If the organization has a support relationship with the wallabag project, request a timeline for the patch.

3. Long-Term Hardening:

• WebView security best practices: For administrators of the wallabag Android project, ensure the WebView implementation disables JavaScript when not strictly required, disables file access, and avoids exposing JavaScript bridge interfaces unless absolutely necessary.
• Input sanitization on the server: Consider patching the wallabag server-side component to sanitize article content before storage, stripping or encoding <script> tags and event handler attributes. This mitigates the XSS at the source rather than relying on the client.
• User education: Train users to recognize that saving arbitrary web content into wallabag carries execution risk, similar to opening attachments in email.
• Least privilege: Ensure the Android app runs with the minimum required permissions. Revoke read/write storage permissions if not essential, and restrict background network access via firewall or VPN policy.
• Regular risk assessment: Re-evaluate the risk posed by third-party Android applications in the enterprise; consider sandboxing or containerizing such apps.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82089 — Official National Vulnerability Database entry (source of the vulnerability description).
2. Wallabag Official Website: https://wallabag.org — Vendor site; check for release notes and advisories regarding the Android application.
3. Wallabag GitHub Repository: https://github.com/wallabag/android-app — Source code repository for the vulnerable application (package fr.gaulupeau.apps.InThePoche); monitor for commits addressing WebView sanitization.
4. CWE-79 Reference: https://cwe.mitre.org/data/definitions/79.html — Cross-Site Scripting weakness definition and common mitigation guidance.
5. MITRE ATT&CK — T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique, relevant for tracking the exploitation phase.

Threat Actor Activity: No known threat actor campaigns, exploit-in-the-wild evidence, or CISA KEV inclusion have been identified for CVE-2026-82089 as of the publication date of this report. The vulnerability is classified as unpatched with no public PoC; however, the XSS class is well-understood and actively abused in other contexts, so targeted exploitation should be considered plausible once the vulnerability becomes more widely known.