Log in Start free

Vulnerability · Published Jun 17, 2026 · Assigned by GitHub_M

CVE-2026-48822Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links

Medium 5.8

In plain English

A medium-severity cross-site scripting in Shaarli from shaarli. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.1%top 98.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown link. The vulnerability originates in the filterProtocols method within BookmarkMarkdownFormatter.php.This method attempts to sanitize Markdown links by filtering dangerous protocols (such as javascript:) before rendering. It uses the following regular expression: (#]\((.*?)\)#is). This regex is designed to detect inline Markdown links, but it fails to detect Markdown reference-style links because reference-style links are resolved by the Markdown parser after preprocessing. The filterProtocols method never inspects the actual URL used in these references and as a result, an attacker can supply a javascript: URI inside a reference definition. This issue has been fixed in version 0.16.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12shaarlino fix listedDEBIAN-CVE-2026-48822
Debian:13shaarlino fix listedDEBIAN-CVE-2026-48822

Affected products (as reported)

VendorProductVersions
shaarli Shaarli < 0.16.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References