Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Shaarli tags can let attackers run code

CVE-2026-24476 · published 9 months ago
Summary

The Shaarli bookmarking tool lets users add tags. Before version 0.16.0, a specially crafted tag could break the page and insert unwanted code, potentially letting an attacker run scripts in visitors' browsers. Upgrade Shaarli to version 0.16.0 or later to stop this risk.

What to do
  • Update debian shaarli to version 0.12.1+dfsg-8+deb12u2.
  • Update debian shaarli to version 0.14.0+dfsg-2+deb13u1.
  • Update shaarli_project shaarli to version 0.16.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– shaarli_project shaarli < 0.16.0
cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*
Debian:12 debian shaarli < 0.12.1+dfsg-8+deb12u2
Fix: upgrade to 0.12.1+dfsg-8+deb12u2
Debian:13 debian shaarli < 0.14.0+dfsg-2+deb13u1
Fix: upgrade to 0.14.0+dfsg-2+deb13u1
Original advisory text
Shaarli vulnerable to stored XSS via Suggested Tags
Shaarli is a personal bookmarking service. Prior to version 0.16.0, crafting a malicious tag which starting with `"` prematurely ends the `<input>` tag on the start page and allows an attacker to add arbitrary html leading to a possible XSS attack. Version 0.16.0 fixes the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 Jan 2026
Updated26 Oct 2026
First seen6 Mar 2026
Sources
CVE-2026-24476 · NVD
DEBIAN-CVE-2026-24476 · OSV
CVE-2026-24476 · OSV
GHSA-g3xq-mj52-f8pg · GHSA
Track software like this
Free during beta