The wallabag Android application (fr.gaulupeau.apps.InThePoche) loads data returned by the /api/entries endpoint directly into a WebView without sanitisation, creating an XSS vulnerability (CWE‑79). An attacker who can supply a crafted entry payload can inject arbitrary HTML or JavaScript that will be executed with the app’s privileges. The likely effect is that the injected script can access data stored locally by the app, potentially including authentication credentials, and can trigger actions within the app on the user’s behalf. This inference is based on the typical behaviour of scripts run inside an app’s WebView.

The vulnerability affects versions of the wallabag Android app up to and including 2.6.0. No other versions or platforms are reported to be impacted. The issue is specific to the Android client and is not present in non‑mobile or web‑only deployments.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score of < 1% indicates a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, so no public exploits are known. The likely attack vector is remote: an attacker who can influence the content of /api/entries or who can modify stored entries can trigger the vulnerability. Since the app must be installed and running for the malicious payload to be displayed, the risk is significant for users of vulnerable versions while the exploitation requires only a crafted API response.