CVE-2026-24476CWE-79
Shaarli vulnerable to stored XSS via Suggested Tags
Medium · published January 26, 2026
What it is
Shaarli is a personal bookmarking service. Prior to version 0.16.0, crafting a malicious tag which starting with `"` prematurely ends the `<input>` tag on the start page and allows an attacker to add arbitrary html leading to a possible XSS attack. Version 0.16.0 fixes the issue.
The record
Technical detail
- CVSS v4.0
- 5.3 · MEDIUM
- Vector
- CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00175 · 6.7th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-01-26T22:26Z
EPSS history
Timeline