CVE-2026-50190

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `<title>` element without HTML escaping. A bookmark title containing `</title><script>...</script>` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `<title>` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.

• CWE-79

• https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv
• https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv

Published

Aug 20, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50185RustCrypto CMOV provides conditional move CPU intrinsics whi…3.3
• CVE-2026-501864gaBoards is a boards system for realtime project management…8.8
• CVE-2026-50187Oh My Zsh is a community-driven framework for managing Zsh c…8.8
• CVE-2026-50188Kirby is an open-source content management system. Prior to …6.9
• CVE-2026-50189Appsmith is a platform to build admin panels, internal tools…7.2
• CVE-2026-5019A security vulnerability has been detected in code-projects …9.8
• CVE-2026-501914gaBoards is a boards system for realtime project management…8.8
• CVE-2026-50192Kerberos Agent is an open source video (surveillance) manage…6.9
• CVE-2026-50193jackson-databind contains the general-purpose data-binding f…7.5
• CVE-2026-50194Steeltoe is an open source project that provides a collectio…8.2
• CVE-2026-50195containerd is an open-source container runtime. Versions pri…9.9
• CVE-2026-50196Steeltoe is an open source project that provides a collectio…7.5