XSS in Getpocket Pocket

CVE-2026-82090

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (20.2th percentile) — read the EPSS interpretation.

Affected products

Getpocket Pocket

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (technical-description, exploit, third-party-advisory)