A high-severity Cross-site Scripting vulnerability in the wallabag Android application allows authenticated attackers to execute arbitrary scripts via insecure WebView data processing.

The application is susceptible to CWE-79, where data fetched from the /api/entries endpoint is rendered in a WebView without proper neutralization. This vulnerability requires the attacker to be an authenticated user and relies on user interaction to trigger the malicious script execution.

Successful exploitation of this XSS vulnerability could allow an attacker to execute malicious scripts within the context of the user session. This may lead to the theft of session tokens, unauthorized access to sensitive user data stored within the wallabag instance, or further client-side attacks. With a CVSS score of 8.8, this flaw represents a significant risk to data confidentiality and integrity for users of the application.

Immediate Action: Monitor the official wallabag GitHub security advisories for the release of a patched version and update the application immediately once available.

Proactive Monitoring: Review application logs for unusual patterns in API traffic and monitor for suspicious activity originating from the WebView component.

Compensating Controls: Ensure that the wallabag server-side instance implements strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be loaded, potentially mitigating the impact of XSS.

Public Exploit Available: Unknown.

Given the high CVSS severity and the potential for unauthorized script execution, users should exercise caution when syncing content from untrusted sources. Security teams must prioritize updating the wallabag Android application as soon as a fix is published by the vendor to eliminate the underlying vulnerability.