DOM-Based XSS Vulnerability in Shaarli Personal Bookmarking Service

CVE-2026-48821

What is CVE-2026-48821?

Shaarli, a personal bookmarking service, is vulnerable to a DOM-based Cross-Site Scripting issue in versions 0.16.1 and prior. This vulnerability arises from the Thumbnail Synchronizer feature, where malicious bookmark titles can be injected into the DOM through an improperly sanitized AJAX response. When an administrator updates thumbnails, the backend sends bookmark titles formatted with 'raw' output, which are subsequently inserted into the DOM via innerHTML. This flaw can lead to serious security risks, including session hijacking, privilege escalation, backdoor injections, and a full compromise of the system. The vulnerability has been addressed in version 0.16.2.

References