Vulnerability Description
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
Related Weaknesses (CWE)
References
- https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupe
- https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupe
- https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupe
- https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupe
- https://github.com/wallabag/android-app/blob/master/app/src/main/java/fr/gaulupe
- https://github.com/wallabag/wallabag/security/advisories/GHSA-q2g2-www6-wf5h
FAQ
What is CVE-2026-82089?
CVE-2026-82089 is a documented vulnerability. The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
How severe is CVE-2026-82089?
CVSS scoring is not yet available for CVE-2026-82089. Check NVD for updates.
Is there a patch for CVE-2026-82089?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.