Vulnerability identifier: #VU140698
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
CVE-ID: CVE-2026-50190
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Shaarli
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the Shaarli origin.
The vulnerability exists due to cross-site scripting in the public permalink page title rendering in BookmarkListController and the RainTPL template when rendering a bookmark title into the document
element without HTML escaping. A remote attacker can supply a bookmark title containing crafted HTML script content to execute arbitrary JavaScript in the Shaarli origin.</p><p>User interaction is required to visit the affected public permalink page, and the payload can be planted when an administrator bookmarks an attacker-controlled URL whose remote page title is stored verbatim.</p> </div>
<br>
<div><h2 class="text-2xl font-bold mb-4">How to mitigate CVE-2026-50190</h2></div>
<div>
Install security update from vendor's website. </div>
<br>
<div><h2 class="text-2xl font-bold mb-4">Sources</h2></div>
<div>
<ul>
<li><a href="https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv" target="_blank" class="text-primary hover:underline">https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv</a></li>
</ul>
</div>
</div>
</section>
</main>
<script src="/js/header.js"></script>
<script src="/js/script.js"></script>
<script src="/js/cookie-consent.js"></script>
<footer class="border-t border-border py-8 mt-20">
<div class="container mx-auto px-4 text-center text-muted-foreground">
<div class="flex items-center justify-center gap-6 mb-4"><a href="/terms.php" class="hover:text-foreground transition-colors">Terms of Use</a><span>|</span><a href="/privacy.php" class="hover:text-foreground transition-colors">Privacy Policy</a>|</span><a href="/contacts/" class="hover:text-foreground transition-colors">Contacts</a></div>
<p>© 2026 Cybersecurity Help s.r.o.</p>
</div>
</footer>
</div>
</div>
<div id="cookieConsent" class="cookie-consent hidden">
<!-- Header -->
<div class="cookie-consent-header">
<div class="cookie-consent-title">
<svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
<path d="M12 2a10 10 0 1 0 10 10 4 4 0 0 1-5-5 4 4 0 0 1-5-5"/>
<path d="M8.5 8.5v.01"/>
<path d="M16 15.5v.01"/>
<path d="M12 12v.01"/>
<path d="M11 17v.01"/>
<path d="M7 14v.01"/>
</svg>
Cookie Settings
</div>
<button type="button" id="cookieClose" class="cookie-consent-close" aria-label="Close">
<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
<path d="M18 6 6 18"/>
<path d="m6 6 12 12"/>
</svg>
</button>
</div>
<!-- Content -->
<div class="cookie-consent-content">
<p class="cookie-consent-text">
We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic.
</p>
<!-- Details Toggle -->
<button type="button" id="cookieToggleDetails" class="cookie-consent-toggle-details">
<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
<path d="m6 9 6 6 6-6"/>
</svg>
Customize settings
</button>
<!-- Cookie Options (Granular Controls) -->
<div id="cookieOptions" class="cookie-consent-options">
<!-- Necessary -->
<div class="cookie-option">
<div class="cookie-option-info">
<p class="cookie-option-name">Necessary</p>
<p class="cookie-option-desc">Required for basic site functionality</p>
</div>
<label class="cookie-switch">
<input type="checkbox" data-cookie-type="necessary" checked disabled>
<span class="cookie-switch-slider"></span>
</label>
</div>
<!-- Google Analytics -->
<div class="cookie-option">
<div class="cookie-option-info">
<p class="cookie-option-name">Google Analytics</p>
<p class="cookie-option-desc">Helps us understand how visitors use our site</p>
</div>
<label class="cookie-switch">
<input type="checkbox" data-cookie-type="analytics">
<span class="cookie-switch-slider"></span>
</label>
</div>
</div>
<!-- Buttons -->
<div id="cookieButtons" class="cookie-consent-buttons">
<button type="button" class="cookie-btn cookie-btn-primary" id="cookieAcceptAll">Accept All</button>
<button type="button" class="cookie-btn cookie-btn-secondary" id="cookieDeclineAll">Decline All</button>
</div>
<!-- Privacy Link -->
<p class="cookie-consent-privacy">
Learn more in our <a href="/privacy.php">Privacy Policy</a>
</p>
</div>
</div>
<!-- reCAPTCHA Blocker Overlay -->
<div id="recaptchaBlocker" class="recaptcha-blocker hidden">
<div class="recaptcha-blocker-backdrop"></div>
<div class="recaptcha-blocker-modal">
<div class="recaptcha-blocker-icon">
<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
<rect width="18" height="11" x="3" y="11" rx="2" ry="2"/>
<path d="M7 11V7a5 5 0 0 1 10 0v4"/>
</svg>
</div>
<h3 class="recaptcha-blocker-title">Please verify you're human</h3>
<p class="recaptcha-blocker-text">Complete the CAPTCHA below or accept cookies to continue browsing.</p>
<div id="recaptchaWidget" class="recaptcha-widget"></div>
<div class="recaptcha-blocker-divider">
<span>or</span>
</div>
<button type="button" class="cookie-btn cookie-btn-primary" id="recaptchaAcceptCookies">Accept Cookies</button>
</div>
</div>
</body>
</html>