CVE-2026-48822 Overview
CVE-2026-48822 is a stored Cross-Site Scripting (XSS) vulnerability in Shaarli, a personal bookmarking service. The flaw affects versions 0.16.1 and prior, residing in the Markdown-to-HTML conversion process used to render the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown reference-style link, bypassing the protocol sanitization in BookmarkMarkdownFormatter.php. The vendor released version 0.16.2 to address the issue. The vulnerability is classified under [CWE-79].
Critical Impact
Authenticated attackers can store JavaScript payloads in bookmark descriptions that execute in the browser of any user viewing the affected bookmark.
Affected Products
- Shaarli versions 0.16.1 and prior
- Component: BookmarkMarkdownFormatter.php
- Fixed in Shaarli version 0.16.2
Discovery Timeline
- 2026-06-17 - CVE-2026-48822 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-48822
Vulnerability Analysis
The vulnerability resides in the filterProtocols method of BookmarkMarkdownFormatter.php. This method sanitizes Markdown links by stripping dangerous URI schemes such as javascript: before the Markdown parser converts the content to HTML. The sanitization relies on the regular expression (#]\((.*?)\)#is), which matches only inline Markdown link syntax in the form [text](url). Reference-style Markdown links, written as [text][ref] with a separate [ref]: url definition, are resolved by the Markdown parser after the preprocessing stage. The filterProtocols method never inspects the URL declared in a reference definition, allowing attacker-supplied URIs to pass through to the rendered output.
Root Cause
The root cause is incomplete input validation in the protocol filter. The regex assumes all Markdown links use the inline (url) syntax and ignores the alternative reference-link grammar defined by CommonMark. Because the parser resolves references at a later stage, the sanitization runs against a representation of the document where the malicious URL is not yet visible to the filter.
Attack Vector
Exploitation requires an authenticated user with permission to create or edit bookmarks. The attacker submits a description containing a reference-style link such as [click][x] followed by [x]: javascript:alert(1). When any user subsequently views the bookmark, the rendered HTML contains an anchor with the javascript: URI. Clicking the link executes the script in the victim's session context, enabling session token theft, CSRF against the Shaarli instance, or arbitrary actions performed as the viewer. User interaction is required, and the attacker must hold authenticated privileges on the target instance.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-2hgr-63wv-x462 for additional technical detail.
Detection Methods for CVE-2026-48822
Indicators of Compromise
- Bookmark description fields containing reference-style Markdown definitions that resolve to javascript:, data:, or vbscript: URIs.
- Rendered HTML output from Shaarli containing <a href="javascript:..."> within bookmark description content.
- Unexpected outbound requests or session-related actions originating from browsers that recently viewed bookmark pages.
Detection Strategies
- Review the Shaarli datastore for stored bookmark descriptions and search for the string javascript: within Markdown reference definitions.
- Inspect web server access logs for unusual POST requests to bookmark creation or edit endpoints from low-trust authenticated accounts.
- Run static analysis against the deployed BookmarkMarkdownFormatter.php to confirm whether the patched filterProtocols logic is present.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to surface inline script and javascript: navigation attempts.
- Monitor authentication and account creation events on the Shaarli instance to detect untrusted users who could plant payloads.
- Alert on edits to bookmark records that introduce Markdown link reference syntax pointing to non-HTTP schemes.
How to Mitigate CVE-2026-48822
Immediate Actions Required
- Upgrade Shaarli to version 0.16.2 or later, which corrects the filterProtocols regex to cover reference-style links.
- Audit existing bookmarks for stored payloads referencing javascript: and remove or sanitize any matching entries.
- Restrict bookmark creation privileges to trusted accounts until the upgrade is complete.
Patch Information
The issue is fixed in Shaarli 0.16.2. Release notes and source changes are available in the GitHub Release v0.16.2. Administrators should follow the standard Shaarli upgrade procedure and verify the deployed version after deployment.
Workarounds
- Disable Markdown rendering for bookmark descriptions if the deployment supports a plaintext fallback.
- Apply a strict Content Security Policy that forbids inline script execution and javascript: navigation in anchor elements.
- Limit account registration and revoke bookmark-edit privileges from untrusted users until patching is complete.
# Upgrade Shaarli to the patched release
cd /var/www/shaarli
git fetch --tags
git checkout v0.16.2
composer install --no-dev --optimize-autoloader
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
