EPUB Reader HTML Sanitization Bypass via iframe srcdoc

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the re

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Readest, an open-source EPUB reader built on Tauri, contains a critical HTML sanitization bypass in versions before 0.11.16. The vulnerability stems from incomplete DOMPurify configuration that only forbids <script> tags while failing to restrict other dangerous HTML elements. Attackers can exploit this by embedding malicious HTML within iframe srcdoc attributes, which DOMPurify treats as opaque strings rather than parsed content. This allows arbitrary script execution when users open specially crafted EPUB files, affecting anyone using vulnerable versions of Readest to read untrusted e-books. The CVSS score of 8.8 reflects the high severity of achieving code execution through a common file format.

Casky's 323 matching security skills detect the attack patterns underlying this vulnerability by analyzing MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Claude AI with extended reasoning identifies CWE-79 (Improper Neutralization of Input During Web Page Generation) patterns that indicate insufficient input validation and output encoding. Practitioners using Casky would observe findings related to: (1) incomplete allowlist-based sanitization configurations that fail to account for attribute-level injection vectors, (2) framework misconfigurations where security libraries are deployed without understanding their parsing behavior across HTML contexts, and (3) supply chain risks in open-source dependencies where security controls have narrow scope. The skill set enables detection of similar sanitizer bypasses across web components, iframe handling, and dynamic content rendering—critical for identifying variants of this class of vulnerability in other applications.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82642.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-82642

Casky has 323 skills that investigate the attack patterns behind CVE-2026-82642. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn