Readwise Reader for Android permits arbitrary attributes on SVG and PATH elements because its sanitize‑html configuration uses a wildcard attribute rule that ignores script‑capable attributes such as event handlers like 'onload' and 'onerror'. As a result, a malicious document that includes SVG code can evade sanitization and embed JavaScript that executes when rendered in the Reader WebView. The flaw enables an attacker to run arbitrary client‑side scripts within the application’s context, potentially exfiltrating data, hijacking the user session, or loading additional malware. The vulnerability is a classic example of a cross‑site scripting weakness that breaches confidentiality and integrity for users who open or view compromised content.

The affected product is Readwise Reader for Android. No specific version information is provided by the vendor, and the affected‑version list is empty. All installations of the App that use the default sanitize‑html configuration are at risk until a fix is applied.

EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. No CVSS score is supplied, but the nature of the flaw—client‑side XSS that can execute arbitrary JavaScript in the user’s context—implies a significant potential impact. The likely attack vector is the attacker delivering a crafted document, note, or other content that contains malicious SVG to a user of the Reader. If the application renders that content in an uncontrolled WebView, the embedded script will run with the privileges of the app. Without visibility into whether any user‑triggered input mechanisms exist, the exact conditions for exploitation remain unclear, but the underlying weakness is inherent to the sanitization process itself. This means that any delivery mechanism that ultimately leads to the WebView rendering is a potential exploitation path.