Readest vulnerabilities

In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process.

Readest prior to 0.11.10 contains an unauthenticated /api/opds/proxy route that fetches an attacker-controlled URL server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during redirects. The route also accepts caller-controlled outbound headers and Authorization values and reflects the upstream status and response body.

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, so an attacker can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute. The script can access Tauri IPC commands, escalating to arbitrary code execution.