SB2026080117 - Cross-site scripting in Shaarli

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080117

SB2026080117 - Cross-site scripting in Shaarli

Published: August 1, 2026

Security Bulletin ID SB2026080117
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2026-50190)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the Shaarli origin.

The vulnerability exists due to cross-site scripting in the public permalink page title rendering in BookmarkListController and the RainTPL template when rendering a bookmark title into the document <title> element without HTML escaping. A remote attacker can supply a bookmark title containing crafted HTML script content to execute arbitrary JavaScript in the Shaarli origin. User interaction is required to visit the affected public permalink page, and the payload can be planted when an administrator bookmarks an attacker-controlled URL whose remote page title is stored verbatim.


Remediation

Install update from vendor's website.

References