Stored Cross-Site Scripting Vulnerability in Buku's Bookmark List
CVE-2026-121627

5.3MEDIUM

Key Information:

Vendor

Jarun

Status
Buku
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121627?

Buku versions 5.0 to 5.1.1 are impacted by a stored cross-site scripting vulnerability within the bookmark list functionality. An attacker can exploit this flaw by submitting a specially crafted bookmark URL that includes a double quote and event handler through the unprotected /api/bookmarks endpoint. This allows the attacker to execute scripts using the credentials of users who access the affected bookmarks, potentially compromising their session without needing authentication.

Affected Version(s)

buku 5.0 <= 5.1.1

References

https://github.com/jarun/buku/issues/911
issue-tracking
https://github.com/jarun/buku/blob/v5.1.1/bukuserver/view...
technical-description
https://github.com/jarun/buku
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.