Readwise Reader for Android builds URLs in its embedded WebView by directly inserting values from document metadata into URL strings that are then added to the page via innerHTML. Because the metadata values are not encoded for either HTML or JavaScript contexts, an attacker can craft a document whose metadata supplies payload text that breaks out of the intended URL structure and injects executable script. The vulnerability is a stored XSS flaw, meaning that once a malicious document is synchronized to a device it can persistently compromise any user who opens it.

The affected product is Readwise Reader for Android. No specific version information is available in the advisory, so all current and legacy releases could be impacted until a patch is applied.

The advisory lists a CVSS score of 6.1, indicating moderate severity. The EPSS score is not available, so a precise exploitation likelihood cannot be quantified. Attackers would need to supply a malicious document containing crafted metadata and persuade a user to sync and open it; once displayed, the injected script runs in the app context, potentially enabling session hijacking or data theft. The issue is not listed in the CISA KEV catalog, suggesting no known exploitation yet. Standard XSS mitigations apply.