CVE-2019-18426

HighCVSS 8.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 21, 2020
Last modified
Jun 17, 2026
Added to CISA KEV
May 23, 2022
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-18437.5A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPNCVE-2019-18445.3A vulnerability in certain attachment detection mechanisms of the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remotCVE-2019-184464.3An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2).CVE-2019-184474.3An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions.CVE-2019-184486.5An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control.CVE-2019-184494.3An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issCVE-2019-18458.6A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, CisCVE-2019-184504.3An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions.CVE-2019-184516.1An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an CVE-2019-184525.3An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a privateCVE-2019-184534.3An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure CVE-2019-184546.1An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has
CVE-2019-18426: High severity, CVSS 8.2 | Vulnix