Readwise Reader for Android fails to sanitize metadata embedded in imported documents before rendering it in a WebView. The author meta tag, which can be supplied by an attacker, is injected directly into the page's innerHTML. This flaw allows an attacker to embed malicious JavaScript that is stored with the document and runs whenever any user opens the file on a device that has synced it. The result is a stored cross‑site scripting capability that could steal credentials, exfiltrate local data, or perform actions on behalf of the victim.

The vulnerability affects the Readwise Reader application on the Android platform. Any device running versions of the app that include the unsanitized metadata processing code is susceptible. The exact affected releases are not listed in the advisory, so all current users of the app should assume risk until a patch is released by Readwise.

Because the flaw is exploitable through an attacker‑controlled document stored on a device, an adversary who manages to deliver a crafted file can trigger the stored XSS whenever the file is opened. The EPSS score is not available and the vulnerability is not in CISA’s KEV catalog, indicating that the exploitation probability has not been quantified, but the impact of XSS is well‑understood and the attack requires no network connectivity beyond the delivery of the malicious document. If an attacker can get a user to import a poisoned document, the stored XSS can persist across device syncs, providing a persistent threat surface.