CVE-2026-50190

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50190", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-03T22:05:13.645Z", "datePublished": "2026-08-20T18:49:48.952Z", "dateUpdated": "2026-08-20T19:02:02.984Z"}, "containers": {"cna": {"title": "Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv"}], "affected": [{"vendor": "shaarli", "product": "Shaarli", "versions": [{"version": "< 0.16.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:50:04.209Z"}, "descriptions": [{"lang": "en", "value": "Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `<title>` element without HTML escaping. A bookmark title containing `</title><script>...</script>` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `<title>` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction \u2014 and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue."}], "source": {"advisory": "GHSA-xm98-h5jj-64xv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T19:01:55.293616Z", "id": "CVE-2026-50190", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:02:02.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50190", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T19:01:55.293616Z"}}}], "references": [{"url": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:01:36.247Z"}}], "cna": {"title": "Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page", "source": {"advisory": "GHSA-xm98-h5jj-64xv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "shaarli", "product": "Shaarli", "versions": [{"status": "affected", "version": "< 0.16.3"}]}], "references": [{"url": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv", "name": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `<title>` element without HTML escaping. A bookmark title containing `</title><script>...</script>` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `<title>` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction \u2014 and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:50:04.209Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50190", "state": "PUBLISHED", "dateUpdated": "2026-08-20T19:02:02.984Z", "dateReserved": "2026-06-03T22:05:13.645Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T18:49:48.952Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Shaarli", "vendor": "shaarli", "versions": [{"status": "affected", "version": "< 0.16.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `<title>` element without HTML escaping. A bookmark title containing `</title><script>...</script>` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `<title>` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction \u2014 and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue."}, {"lang": "es", "value": "Shaarli es un servicio personal de marcadores. Versiones anteriores a la 0.16.3 son vulnerables a XSS almacenado en \u2019application/front/controller/visitor/BookmarkListController.php\u2019. El gestor \u2019permalink\u2019 concatena el \u2019$bookmark -> getTitle()\u2019 en bruto en la variable de plantilla \u2019pagetitle\u2019 y la plantilla RainTPL lo emite en el elemento \u2019[title]\u2019 del documento sin escape HTML. Un t\u00edtulo de marcador que contiene \u2019[/title][script_tag]...[/script]\u2019 cierra el t\u00edtulo del documento prematuramente y el script inyectado se ejecuta en el origen de Shaarli para cualquier visitante de \u2019/shaare/{hash}\u2019. El capturador de metadatos de Shaarli copia el texto \u2019[title]\u2019 de una p\u00e1gina remota textualmente en el t\u00edtulo del marcador local, por lo que un atacante que aloja una URL controlada por el atacante y convence a un administrador para que la marque, implanta la carga \u00fatil sin interacci\u00f3n adicional - y el permalink resultante se activa para cada visitante, incluido el administrador, en el primer guardado, proporcionando una toma de control de cuenta de administrador de un solo uso. La versi\u00f3n 0.16.3 corrige el problema."}], "id": "CVE-2026-50190", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50190", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T19:01:55.293616Z", "version": "2.0.3"}}]}, "published": "2026-08-20T19:16:53.907", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.16.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Shaarli", "source": "cna", "vendor": "shaarli"}, "product": "shaarli", "vendor": "shaarli"}], "created": "2026-08-20T21:30:05.621323+00:00", "updated": "2026-08-21T01:30:05.842987+00:00", "vendors": ["shaarli", "shaarli$PRODUCT$shaarli"]}