# CVE-2019-18426

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

- Page: https://www.vulneraibility.com/cve/CVE-2019-18426
- CVSS: 8.2
- Known exploited: yes, in CISA KEV since 2022-05-23; CISA due date 2022-06-13
- EPSS: 68.08% (percentile 99.3)
- Public exploit code: 1 on Exploit-DB · 1 GitHub proof of concept (first 2020-02-29)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-02-07)
- Weakness: CWE-79
- Published: 2020-01-21

## Affected versions

- Facebook WhatsApp Desktop: affected 0.3.9309; < 0.3.9309

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.facebook.com/security/advisories/cve-2019-18426
- [other] http://packetstormsecurity.com/files/157097/WhatsApp-Desktop-0.3.9308-Cross-Site-Scripting.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18426

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.