CVE-2026-57566
CriticalCVSS 9.3Summary
Readest prior to 0.11.10 contains an unauthenticated /api/opds/proxy route that fetches an attacker-controlled URL server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during redirects. The route also accepts caller-controlled outbound headers and Authorization values and reflects the upstream status and response body.
Risk Assessment
A remote attacker could use the service as an open request proxy and, on deployments with internal-network access, retrieve cloud metadata or internal-service responses. The risk mainly affects Node, Docker, and other self-hosted deployments.
Recommendation
Update Readest to version 0.11.10. Also restrict network access to the service and verify that no unauthorized requests to internal resources occurred.
Other vulnerabilities in Readest
See all- CVE-2026-57567High
In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process.
- CVE-2026-82642High
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, so an attacker can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute. The script can access Tauri IPC commands, escalating to arbitrary code execution.
Original NVD description (English source)
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS