{"id":"CVE-2026-82089","details":"The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.","aliases":["CVE-2026-82081","GHSA-q2g2-www6-wf5h"],"modified":"2026-08-30T03:30:46.658437529Z","published":"2026-08-28T03:14:20.421Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82089.json"},"references":[{"type":"WEB","url":"https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/data/StorageHelper.java"},{"type":"WEB","url":"https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/events/EventProcessor.java"},{"type":"WEB","url":"https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/service/workers/ArticleAsFileDownloader.java"},{"type":"WEB","url":"https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/service/workers/ArticleUpdater.java"},{"type":"WEB","url":"https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupeau/apps/Poche/ui/ReadArticleActivity.java"},{"type":"WEB","url":"https://play.google.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82089.json"},{"type":"ADVISORY","url":"https://github.com/wallabag/wallabag/security/advisories/GHSA-q2g2-www6-wf5h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82089"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wallabag/android-app","events":[{"introduced":"0"},{"fixed":"686d72a0ce3553e27bdc8c0dc1c2a1ea2c411c98"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"2.6.0"},{"fixed":"2.6.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["2.5.3","2.5.2","2.5.1","2.5.0","2.4.3","2.4.2","2.4.1","2.4.0","2.4.0-beta.6","2.4.0-beta.5","2.4.0-beta.4","2.4.0-beta.3","2.4.0-beta.2","2.4.0-beta.1","2.3.0","2.3.0-beta.4","2.3.0-beta.3","2.3.0-beta.2","2.2.4","2.3.0-beta.1","2.2.3","2.2.2","2.2.1","2.2.0","2.1.0","2.1.0-beta","2.0.2","2.0.1","2.0.0","2.0.0b1","1.12.2","2.0.0a3","2.0.0a","2.0.0a2","1.12.1","1.12.0","1.11.0","1.10.0","1.9.9.5","1.9.9.4b","1.9.9.4","1.9.9.3","1.9.9.2","1.9.9.1","1.9.3.1","1.9.3","1.9.2","1.9.1","1.9","1.8","1.7","1.7b","1.0","0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82089.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/AU:Y/R:U/V:C/RE:M/U:Green"}]}