Stored XSS Vulnerability in Shaarli Personal Bookmarking Service

CVE-2026-50190

What is CVE-2026-50190?

Shaarli, a personal bookmarking service, is prone to a stored XSS vulnerability due to improper handling of bookmark titles. Specifically, versions prior to 0.16.3 do not escape HTML in the document title, allowing an attacker to inject malicious scripts. By exploiting this vulnerability, an attacker can manipulate the bookmark title with a crafted URL. When an administrator bookmarks this URL, the injected script executes immediately upon saving the bookmark, compromising the security of the Shaarli instance and potentially leading to an administrator account takeover. This flaw highlights the importance of proper HTML escaping to mitigate XSS risks.

References