CVE-2026-48823 Overview
CVE-2026-48823 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Shaarli, a personal bookmarking service. The flaw affects versions 0.16.1 and prior in the tag filtering functionality. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark, also known as a Shaare. The malicious payload is stored in the database and later executed when users interact with the Filter by tag search feature on the homepage. The issue has been fixed in version 0.16.2.
Critical Impact
Authenticated attackers can store JavaScript payloads in tag fields, executing arbitrary script in the browsers of administrators and privileged users who use the tag filter on the homepage.
Affected Products
- Shaarli versions 0.16.1 and prior
- Shaarli homepage Filter by tag interface
- Administrator and privileged user sessions interacting with tag filtering
Discovery Timeline
- 2026-06-17 - CVE-2026-48823 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-48823
Vulnerability Analysis
The vulnerability is a stored XSS issue in Shaarli's tag handling logic. User-supplied input in the tags field is not properly sanitized or output-escaped before being rendered in the tag filtering interface. When a bookmark is created with a malicious payload inside the tag field, the payload is persisted in the database. Later, when a user searches using Filter by tag on the homepage, the application renders matching tags dynamically. If the tag value contains HTML with JavaScript event handlers, it is injected directly into the Document Object Model (DOM) and executed in the victim's browser session.
Exploitation requires an authenticated account with permission to create Shaares. Victims are users who later interact with the homepage tag filter, including administrators. Successful exploitation enables session theft, configuration tampering, and actions performed in the security context of the targeted user.
Root Cause
The root cause is missing output encoding on tag values rendered within the Filter by tag template. Shaarli treats stored tag strings as trusted markup at render time, allowing HTML and JavaScript event handler attributes to be inserted into the page without escaping.
Attack Vector
The attacker authenticates to Shaarli and creates a Shaare with a crafted tag containing HTML attributes or event handlers carrying JavaScript. The payload remains dormant in the database. A privileged user later opens the homepage and uses the tag filter feature, triggering execution of the stored script in their browser. See the GitHub Security Advisory GHSA-68qr-fvv8-6mc6 for technical details.
Detection Methods for CVE-2026-48823
Indicators of Compromise
- Bookmark records with tag values containing HTML angle brackets, on* event handler attributes, or javascript: URIs.
- Unexpected outbound HTTP requests originating from administrator browser sessions following use of the tag filter.
- New or modified Shaarli configuration, user accounts, or API tokens with no corresponding administrator action.
Detection Strategies
- Query the Shaarli datastore for tag fields containing characters such as <, >, ", or = that should not appear in normal tag values.
- Inspect web server access logs for requests to /?searchtags= containing reflected script fragments.
- Review browser Content Security Policy (CSP) violation reports if CSP is enforced in front of Shaarli.
Monitoring Recommendations
- Monitor creation of Shaares by non-administrative accounts for tag values exceeding expected length or character set.
- Alert on administrator session activity that immediately follows tag filter usage and results in account or configuration changes.
- Track the Shaarli version in deployment inventories to confirm upgrade to 0.16.2 or later.
How to Mitigate CVE-2026-48823
Immediate Actions Required
- Upgrade Shaarli to version 0.16.2 or later, available at the GitHub Release v0.16.2 page.
- Audit existing bookmarks and remove or sanitize any tag values containing HTML or JavaScript content.
- Rotate session cookies and API tokens for administrators who may have triggered malicious tags.
Patch Information
The maintainers fixed the issue in Shaarli 0.16.2 by applying proper output escaping to tag values rendered in the Filter by tag interface. Refer to the GitHub Security Advisory GHSA-68qr-fvv8-6mc6 for advisory details and the GitHub Release v0.16.2 notes for the patched build.
Workarounds
- Restrict Shaare creation to fully trusted accounts until the upgrade is applied.
- Deploy a strict Content Security Policy that disallows inline script execution on Shaarli pages.
- Place Shaarli behind a web application firewall rule that blocks tag parameters containing HTML metacharacters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
