Executive brief
Shaarli is a personal bookmarking service. Versions prior to 0.16.3 contain a stored cross-site scripting (XSS) vulnerability in the public permalink page, where an attacker can inject malicious JavaScript via a crafted bookmark title. An attacker can trick an administrator into bookmarking a malicious URL, automatically planting the payload; the injected script executes for every visitor including the administrator, enabling account takeover and unauthorized access to bookmarks.
Technical details
The vulnerability is a stored XSS in BookmarkListController.php's permalink handler. The vulnerable code concatenates a raw bookmark title into the page title template variable without HTML escaping, and the RainTPL template emits it unescaped into the HTML document `<title>` element. An attacker-controlled title containing `</title><script>...</script>` closes the document title early and executes arbitrary JavaScript in the Shaarli origin for all visitors. The metadata fetcher copies remote page titles verbatim into bookmark titles, allowing an attacker to socially engineer an administrator into bookmarking an attacker-hosted URL, automatically injecting the payload without further interaction. Session cookies lack HttpOnly flags, enabling payload-based credential theft and administrator account takeover. Fix: apply HTML escaping to bookmark titles, use auto-escaping templates, sanitize fetched titles, and implement strict Content Security Policy.
Affected products
- Shaarli Shaarli prior to 0.16.3
Timeline
- 2026-05-28: disclosed
- 2026-05-28: patched: version 0.16.3