Readest EPUB files are processed through DOMPurify, which in versions before 0.11.16 only disallows the <script> tag. DOMPurify treats the srcdoc attribute of <iframe> elements as opaque, so an attacker can embed an entire HTML document with a <script> tag inside a maliciously crafted srcdoc. When the reader renders the iframe – which is sandboxed with allow-same-origin allow-scripts – the embedded script runs with the same origin as the host application and can call parent.parent.__TAURI_INTERNALS__.invoke(...), granting access to any Tauri IPC command the application is allowed to use. This chain of effects allows the attacker to execute arbitrary code on the host system. The vulnerability is a classic DOM-based XSS / injection flaw, classified as CWE‑79. An unverified EPUB file that contains the crafted iframe can trigger the vulnerability without user interaction beyond opening the file. The integrity of the sandbox does not prevent the script from calling the exposed Tauri API, and the attacker can hide the iframe to remain invisible to the reader. In the absence of an applied patch, exploitation remains limited to a local user who can supply or modify EPUB files. However, the severity is high (CVSS 8.8), the issue is not yet listed in the KEV catalog, and the EPSS score is not available, indicating that the exploitation probability is uncertain but that vulnerability remains significant because it can affect any user who opens the application with a malicious e‑book.

All Readest open‑source e‑book reader installations using the legacy sanitizer configuration—i.e., versions prior to 0.11.16 of the Readest product. The affected component is the EPUB sanitizer located in apps/readest-app/src/services/transformers/sanitizer.ts, which in those versions only forbids the <script> tag. The fix adds 'iframe', 'object' and 'embed' to the FORBID_TAGS list and 'srcdoc' to the FORBID_ATTR list, ensuring that any iframe element is removed or sanitized before rendering.

The CVSS score of 8.8 places the vulnerability in the high severity range. With EPSS not available, the exploitation probability is unknown, but the fact that the issue is not yet in the CISA KEV catalog suggests it is not actively exploited at a large scale. The likely attack vector involves a local user or an attacker who can place a crafted EPUB file on a target’s machine. Once opened in Readest, the malicious srcdoc payload will execute, giving the attacker arbitrary code execution privileges within the host environment.