XSS Vulnerability in Shaarli Personal Bookmarking Service
CVE-2026-24476

5.3MEDIUM

Key Information:

Vendor

Shaarli

Status
Shaarli
Vendor
CVE Published:
26 January 2026

What is CVE-2026-24476?

Shaarli, a personal bookmarking service, contained a vulnerability that allowed the creation of a malicious tag beginning with a double quote ('"'). This flaw led to the premature termination of the <input> tag on the start page, enabling an attacker to inject arbitrary HTML content. Such a weakness opened avenues for potential XSS attacks, compromising the integrity of user data and experience. The issue was addressed in version 0.16.0, which introduced fixes to mitigate the injection risk.

Affected Version(s)

Shaarli < 0.16.0

References

https://github.com/shaarli/Shaarli/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/shaarli/Shaarli/commit/b854c789289c4b0...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.