Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by getpocket

    CVE-2026-82090 (GCVE-0-2026-82090)

    Vulnerability from nvd – Published: 2026-08-28 03:36 – Updated: 2026-08-28 03:36 Unsupported When Assigned
    VLAI
    Summary
    Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alter the application state via native bridge methods.
    Severity
    9.2 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    URL Tags
    https://github.com/FUNFACTOR1/pocket-android-xss-… technical-descriptionthird-party-advisoryexploit
    Impacted products
    Vendor Product Version
    getpocket Pocket Affected: 0 , ≤ 8.33.0.0 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://play.google.com",
          "defaultStatus": "unknown",
          "packageName": "com.ideashower.readitlater.pro",
          "platforms": [
            "Android"
          ],
          "product": "Pocket",
          "programFiles": [
            "assets/html/j/articleview-mobile.js"
          ],
          "vendor": "getpocket",
          "versions": [
            {
              "lessThanOrEqual": "8.33.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUser must have saved at least one article to Pocket prior to attack.\u003c/p\u003e\u003cp\u003eThe DownloadingService must be running in background (default behavior on BOOT_COMPLETED).\u003c/p\u003e\u003cp\u003eNo special configuration required; default installation is vulnerable.\u003c/p\u003e"
            }
          ],
          "value": "User must have saved at least one article to Pocket prior to attack.\n\nThe DownloadingService must be running in background (default behavior on BOOT_COMPLETED).\n\nNo special configuration required; default installation is vulnerable."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pocket through 8.33.0.0 allows XSS because \"Save to Pocket\" injects external HTML into the DOM.\u00a0\u00a0JavaScript code can alter the application state via native bridge methods."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T03:36:23.687Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://github.com/FUNFACTOR1/pocket-android-xss-0click-cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe only mitigation is uninstallation of the application.\u003c/p\u003e"
            }
          ],
          "value": "The only mitigation is uninstallation of the application."
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImmediately uninstall com.ideashower.readitlater.pro from all Android devices.\u003c/p\u003e\u003cp\u003eRevoke Google OAuth grants associated with the Pocket account.\u003c/p\u003e\u003cp\u003eNo vendor-provided mitigation or patch is available. Product is End-of-Life.\u003c/p\u003e"
            }
          ],
          "value": "Immediately uninstall com.ideashower.readitlater.pro from all Android devices.\n\nRevoke Google OAuth grants associated with the Pocket account.\n\nNo vendor-provided mitigation or patch is available. Product is End-of-Life."
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-82090",
    "datePublished": "2026-08-28T03:36:23.687Z",
    "dateReserved": "2026-08-28T03:36:23.090Z",
    "dateUpdated": "2026-08-28T03:36:23.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-82090 (GCVE-0-2026-82090)

    Vulnerability from cvelistv5 – Published: 2026-08-28 03:36 – Updated: 2026-08-28 03:36 Unsupported When Assigned
    VLAI
    Summary
    Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alter the application state via native bridge methods.
    Severity
    9.2 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    URL Tags
    https://github.com/FUNFACTOR1/pocket-android-xss-… technical-descriptionthird-party-advisoryexploit
    Impacted products
    Vendor Product Version
    getpocket Pocket Affected: 0 , ≤ 8.33.0.0 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://play.google.com",
          "defaultStatus": "unknown",
          "packageName": "com.ideashower.readitlater.pro",
          "platforms": [
            "Android"
          ],
          "product": "Pocket",
          "programFiles": [
            "assets/html/j/articleview-mobile.js"
          ],
          "vendor": "getpocket",
          "versions": [
            {
              "lessThanOrEqual": "8.33.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUser must have saved at least one article to Pocket prior to attack.\u003c/p\u003e\u003cp\u003eThe DownloadingService must be running in background (default behavior on BOOT_COMPLETED).\u003c/p\u003e\u003cp\u003eNo special configuration required; default installation is vulnerable.\u003c/p\u003e"
            }
          ],
          "value": "User must have saved at least one article to Pocket prior to attack.\n\nThe DownloadingService must be running in background (default behavior on BOOT_COMPLETED).\n\nNo special configuration required; default installation is vulnerable."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pocket through 8.33.0.0 allows XSS because \"Save to Pocket\" injects external HTML into the DOM.\u00a0\u00a0JavaScript code can alter the application state via native bridge methods."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T03:36:23.687Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://github.com/FUNFACTOR1/pocket-android-xss-0click-cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe only mitigation is uninstallation of the application.\u003c/p\u003e"
            }
          ],
          "value": "The only mitigation is uninstallation of the application."
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImmediately uninstall com.ideashower.readitlater.pro from all Android devices.\u003c/p\u003e\u003cp\u003eRevoke Google OAuth grants associated with the Pocket account.\u003c/p\u003e\u003cp\u003eNo vendor-provided mitigation or patch is available. Product is End-of-Life.\u003c/p\u003e"
            }
          ],
          "value": "Immediately uninstall com.ideashower.readitlater.pro from all Android devices.\n\nRevoke Google OAuth grants associated with the Pocket account.\n\nNo vendor-provided mitigation or patch is available. Product is End-of-Life."
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-82090",
    "datePublished": "2026-08-28T03:36:23.687Z",
    "dateReserved": "2026-08-28T03:36:23.090Z",
    "dateUpdated": "2026-08-28T03:36:23.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}