Readest is vulnerable to Arbitrary Code Execution via Unsanitized iframe srcdoc in the EPUB Sanitizer
readest
< 0.11.16
Readest is an open-source e-book reader built on Tauri. In versions before 0.11.16, EPUB chapter HTML is sanitized with DOMPurify in apps/readest-app/src/services/transformers/sanitizer.ts using a configuration that forbade only the script tag. DOMPurify treats the srcdoc attribute on iframe elements as an opaque string and does not sanitize nested markup inside it. An attacker who can get an iframe to survive sanitization can therefore embed a complete HTML document, including a script tag, inside srcdoc. When the reader renders the chapter, that nested document executes.
The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script running inside it shares the parent origin and can call parent.parent.TAURI_INTERNALS.invoke(...). That grants access to every Tauri IPC command the application is permitted to use and escalates to arbitrary code execution in the Readest process. The iframe can be sized to zero and made transparent so the user sees only normal book text. Opening a crafted EPUB is the required user interaction.
Step 1 - Build a malicious EPUB
Create an EPUB whose chapter XHTML includes an iframe that survives sanitization and carries a nested document in srcdoc. A minimal payload shape:
<iframe srcdoc="<script>parent.parent.__TAURI_INTERNALS__.invoke('plugin:shell|execute', { cmd: 'id' })</script>" width="0" height="0" style="border:0;opacity:0"></iframe>
Step 2 - Open the EPUB in a vulnerable Readest
Install Readest before 0.11.16. Open the crafted EPUB from a normal library import or file-open flow. Do not enable any extra “allow script” view setting; the issue is the srcdoc path through the chapter sanitizer.
Step 3 - Confirm Tauri IPC from the nested document
When the chapter renders, the nested script runs in the sandboxed content iframe with the parent origin. Expected proof: a Tauri invoke from that script succeeds (for example a shell or filesystem command the app already exposes), demonstrating arbitrary code execution in the Readest process while the visible page still looks like ordinary book text.
Upgrade to Readest 0.11.16 or later. The fix adds iframe, object, and embed to the DOMPurify FORBID_TAGS list and adds srcdoc to FORBID_ATTR in apps/readest-app/src/services/transformers/sanitizer.ts (https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb, shipped in v0.11.16). Until an upgrade is available, only open EPUB files from trusted sources.
https://www.cve.org/CVERecord?id=CVE-2026-82642 https://github.com/readest/readest/security/advisories/GHSA-p4x7-pf2c-xrvj https://github.com/readest/readest/pull/4762 https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb https://github.com/readest/readest/releases/tag/v0.11.16