Quick answers
- Is CVE-2026-50190 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-50190 being exploited in the wild.
- How severe is CVE-2026-50190?
- Informational severity, with a CVSS score of 8.6, published 20 August 2026.
- Which products and versions are affected?
- Shaarli prior to 0.16.3.
- Is there a fix for CVE-2026-50190?
- A patch was published on 2026-05-28: version 0.16.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-50190 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-50190?
- Check whether you run Shaarli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored XSS in BookmarkListController.php's permalink handler. The vulnerable code concatenates a raw bookmark title into the page title template variable without HTML escaping, and the RainTPL template emits it unescaped into the HTML document `<title>` element. An attacker-controlled title containing `</title><script>...</script>` closes the document title early and executes arbitrary JavaScript in the Shaarli origin for all visitors. The metadata fetcher copies remote page titles verbatim into bookmark titles, allowing an attacker to socially engineer an administrator into bookmarking an attacker-hosted URL, automatically injecting the payload without further interaction. Session cookies lack HttpOnly flags, enabling payload-based credential theft and administrator account takeover. Fix: apply HTML escaping to bookmark titles, use auto-escaping templates, sanitize fetched titles, and implement strict Content Security Policy.
Affected products
- Shaarli Shaarli prior to 0.16.3
Timeline
- 2026-05-28: disclosed
- 2026-05-28: patched: version 0.16.3