CVE-2026-82089: wallabag Android App XSS Vulnerability

CVE-2026-82089 Overview

CVE-2026-82089 is a cross-site scripting (XSS) vulnerability in the wallabag Android application (package fr.gaulupeau.apps.InThePoche) through version 2.6.0. The application loads data returned by the /api/entries endpoint directly into an Android WebView without sufficient sanitization. An attacker who controls or influences the content served by a wallabag API endpoint can inject JavaScript that executes inside the mobile client's WebView context. The issue is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the wallabag Android WebView, exposing stored article data and enabling further client-side attacks.

Affected Products

wallabag Android application (fr.gaulupeau.apps.InThePoche)
Versions through 2.6.0
Android clients loading /api/entries content into WebView

Discovery Timeline

2026-08-28 - CVE-2026-82089 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82089

Vulnerability Analysis

The wallabag Android client fetches saved article content from the wallabag server via the /api/entries endpoint and renders that content inside an Android WebView. Article bodies stored in wallabag can contain HTML, and the client passes this HTML to the WebView without adequate neutralization of executable script. As a result, HTML <script> tags and inline event handlers included in an entry are executed by the WebView when the user opens the article in the mobile app. The affected code paths are visible across the article rendering and download logic, including ReadArticleActivity, ArticleUpdater, and ArticleAsFileDownloader.

Root Cause

The root cause is missing output encoding and script neutralization before article HTML is passed to WebView. The application trusts server-supplied content, but wallabag entries can originate from arbitrary third-party URLs saved by the user or from other users on a shared instance. Any of those sources can embed script payloads that reach the WebView unchanged.

Attack Vector

An attacker publishes or injects malicious HTML into a resource that a wallabag user saves, or injects content directly into an entry served by an attacker-influenced wallabag instance. When the user opens the entry in the Android app, the WebView loads the attacker's HTML and executes the embedded JavaScript. Exploitation requires user interaction to open the article. Refer to GitHub Security Advisory GHSA-q2g2-www6-wf5h for coordinated disclosure details.

The vulnerability manifests when article HTML retrieved from /api/entries is passed into WebView.loadData or loadDataWithBaseURL without prior sanitization. See the referenced StorageHelper and EventProcessor source files for the rendering pipeline.

Detection Methods for CVE-2026-82089

Indicators of Compromise

Wallabag entries containing <script> tags, javascript: URIs, or inline event handlers such as onerror= and onload= inside the article body.
Outbound network requests from the Android device to unexpected domains immediately after opening a wallabag article.
Server-side wallabag entries with HTML payloads that reference remote script sources unrelated to the original article domain.

Detection Strategies

Scan the wallabag database on the server for entry content fields containing script tags or event handler attributes.
Inspect API responses from /api/entries in transit for HTML script constructs before they reach mobile clients.
Review installed Android application versions across managed devices for fr.gaulupeau.apps.InThePoche at version 2.6.0 or earlier.

Monitoring Recommendations

Monitor mobile telemetry for anomalous WebView navigation and JavaScript-initiated network activity originating from the wallabag package.
Log wallabag server API responses and alert on entries containing script constructs that were not present in the source URL fetch.
Track user-reported rendering anomalies in the wallabag Android client that could indicate injected content.

How to Mitigate CVE-2026-82089

Immediate Actions Required

Restrict use of the wallabag Android application versions through 2.6.0 until a fixed release is installed.
Audit wallabag server content for stored entries containing script payloads and remove or sanitize offending entries.
Limit account creation and API access on shared wallabag instances to trusted users while a patch is pending.

Patch Information

Monitor the wallabag Android repository and the GitHub Security Advisory GHSA-q2g2-www6-wf5h for the fixed version. Upgrade all Android clients to a release that sanitizes /api/entries HTML before rendering in WebView, or that disables JavaScript in the article WebView.

Workarounds

Disable JavaScript execution in the WebView by setting WebSettings.setJavaScriptEnabled(false) in local builds if maintaining a fork.
Sanitize article HTML server-side using an HTML allowlist before it is returned by /api/entries.
Avoid opening wallabag entries from untrusted or unknown sources on the Android app until an updated version is deployed.

bash

# Server-side check: search wallabag database for entries containing script payloads
grep -REn --include='*.sql' -e '<script' -e 'onerror=' -e 'onload=' /path/to/wallabag/backup/