{"id":"CVE-2019-18426","kind":"vulnerability","aliases":["CVE-2019-18426"],"related":[],"title":"Meta Platforms WhatsApp: WhatsApp Cross-Site Scripting Vulnerability","description":"A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.","summary":"A cross-site scripting flaw in WhatsApp Desktop, when paired with WhatsApp for iPhone, lets injected script run in the app. An attacker can use it to read local files on the machine.","severity":"high","cvss":8.2,"epss":0.67859,"exploited":true,"exploited_at":"2022-05-23T00:00:00+00:00","products":[{"name":"Meta Platforms WhatsApp","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ios","macos","vendor","whatsapp-desktop","windows"],"not_affected_if":["not-paired-with-iphone"],"how_to_check":null,"fix":"Apply updates per vendor instructions (CISA KEV entry); the sources do not name a fixed version.","status":"open","published_at":"2020-01-21T21:15:16+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:17:35+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-23T21:17:35Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions (CISA KEV entry); the sources do not name a fixed version.","reach":"unknown","impact":"medium","summary":"A cross-site scripting flaw in WhatsApp Desktop, when paired with WhatsApp for iPhone, lets injected script run in the app. An attacker can use it to read local files on the machine.","category":"vendor","who_cares":["whatsapp-desktop","ios","windows","macos"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in the desktop app and reads local files.","analyst_note":"Find the vendor advisory and fixed WhatsApp Desktop version, and confirm whether the attack needs the user to open a crafted message; see the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-18426.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-paired-with-iphone"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000483,"input_tokens":2835,"output_tokens":400,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-18426':12A,15A '-2019':11A,14A '0.3.9309':69C '2.20.10':79C 'allow':80C 'app':48B 'attack':50B 'click':96C 'craft':103C 'cross':6A,29B,82C 'cross-sit':5A,28B,81C 'cve':10A,13A 'desktop':25B,35B,65C 'exploit':19B,89C 'file':57B,87C 'flaw':32B 'inject':43B 'io':20B 'iphon':41B,75C 'let':42B 'link':98C 'local':56B,86C 'machin':60B 'maco':21B 'messag':105C 'meta':1A,16A 'pair':37B,71C 'platform':2A 'platforms':17A 'preview':99C 'prior':67C,77C 'read':55B,88C 'requir':92C 'run':45B 'script':8A,31B,44B,84C 'site':7A,30B,83C 'special':102C 'text':104C 'use':52B 'vendor':22B 'version':66C,76C 'victim':94C 'vulner':9A,62C,91C 'whatsapp':3A,4A,18A,24B,34B,39B,64C,73C 'whatsapp-desktop':23B 'window':26B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-01-21T21:15:16+00:00","kev":{"dateAdded":"2022-05-23","dueDate":"2022-06-13","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-18426","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-18426","severity":null,"published_at":"2022-05-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2019-18426","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-18426","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-18426","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18426","severity":null,"published_at":"2020-01-21T21:15:16+00:00","modified_at":"2026-06-17T02:25:01+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}