CVE-2026-82089
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
| CWE | CWE-79 |
| Vendor | wallabag |
| Product | android-app |
| Published | Aug 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for wallabag android-app
Be the first to know when new unknown vulnerabilities affecting wallabag android-app are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
wallabag / android-app
0 ≤ 2.6.0
References
github.com: https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/ui/ReadArticleActivity.java github.com: https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/service/workers/ArticleUpdater.java github.com: https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/service/workers/ArticleAsFileDownloader.java github.com: https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/data/StorageHelper.java github.com: https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/events/EventProcessor.java github.com: https://github.com/wallabag/wallabag/security/advisories/GHSA-q2g2-www6-wf5h