Description

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-30T14:17:04.193Z",
  "pubdate": "2026-08-30T14:17:04.193Z",
  "executiveSummary": "Readest versions prior to 0.11.16 are vulnerable to a cross-site scripting (XSS) vulnerability leading to arbitrary code execution within the Tauri environment.\nThe vulnerability originates from an insufficient DOMPurify configuration in apps/readest-app/src/services/transformers/sanitizer.ts, which only restricted the <script> tag while permitting <iframe> elements.\nBy leveraging the srcdoc attribute of an iframe, an attacker can bypass sanitization to inject malicious HTML containing scripts.\nBecause the iframe is rendered with the sandbox=\"allow-same-origin allow-scripts\" attribute, injected scripts inherit the parent's origin, allowing unauthorized access to the __TAURI_INTERNALS__.invoke interface.\nSuccessful exploitation grants the attacker the ability to execute arbitrary system commands, effectively achieving full application compromise.\nThis vulnerability poses a critical risk to users reading untrusted EPUB files, as an invisible, zero-sized iframe can be used to execute payloads without visual indication to the end-user.",
  "technicalDetails": "The root cause of this vulnerability is an improperly configured DOMPurify sanitizer within the Readest e-book reader, specifically located in apps/readest-app/src/services/transformers/sanitizer.ts. In versions prior to 0.11.16, the configuration explicitly used FORBID_TAGS: ['script'], failing to account for the security implications of other active HTML elements.\nDOMPurify treats the srcdoc attribute of an <iframe> element as an opaque string. Consequently, while the sanitizer identifies and removes standalone <script> tags, it does not inspect or sanitize the markup embedded within the srcdoc attribute of an iframe. An attacker can craft an EPUB file containing a malicious <iframe> that remains active post-sanitization.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious EPUB file containing an <iframe> element with a concealed srcdoc attribute. 2) The srcdoc attribute contains a fully formed HTML document with a payload leveraging <script> tags. 3) The Readest application sanitizes the document but permits the iframe. 4) Upon rendering, the browser processes the srcdoc content within the iframe context. 5) The iframe is configured with the sandbox=\"allow-same-origin allow-scripts\" attribute, which is inherently dangerous in a Tauri environment. 6) The script executing within the iframe gains the same origin as the host application, allowing it to traverse the DOM and access parent.parent.__TAURI_INTERNALS__.invoke.\nBy reaching the Tauri IPC bridge through __TAURI_INTERNALS__.invoke, the attacker bypasses the expected application logic and directly invokes available Tauri commands permitted by the application's configuration. This allows for arbitrary code execution on the underlying host operating system.\nThe exploit is highly stealthy; because the attacker can style the iframe to be zero-sized and transparent, the malicious payload executes without altering the appearance of the book text to the user.\nThis vulnerability affects all versions of Readest prior to 0.11.16. Exploitation requires no authentication or specific user interaction beyond opening the malicious EPUB document, and there is no network exposure requirement, as the attack is fully contained within the parsing of the local file."
}