DEBIAN-CVE-2026-48823
Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionality of Shaarli. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark (Shaare). The malicious payload is stored and later executed when users interact with the "Filter by tag" search feature on the homepage. User-supplied input in the tags field is not properly sanitized or output-escaped before being rendered in the tag filtering interface. When a bookmark is created with a malicious payload inside the tag field, the payload is stored in the database. Later, when a user searches using the "Filter by tag" functionality on the homepage, the application renders matching tags dynamically. If the tag value contains HTML with JavaScript event handlers, it is injected into the DOM. This impacts anyone interacting with the "Filter by tag" search functionality, administrators and privileged users. This issue has been fixed in version 0.16.2.
DEBIAN-CVE-2026-48823
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-48823
shaarli
Source reference: /affected/0/package/name
- Affected versions
- 0.12.1+dfsg-8
Source reference:
/affected/0/versions0.12.1+dfsg-8+deb12u1Source reference:
/affected/0/versions0.12.1+dfsg-8+deb12u2Source reference:
/affected/0/versions0.13.0+dfsg-1Source reference:
/affected/0/versions0.13.0+dfsg-2Source reference:
/affected/0/versions0.13.0+dfsg-3Source reference:
/affected/0/versions0.13.0+dfsg-4Source reference:
/affected/0/versions0.13.0+dfsg-5Source reference:
/affected/0/versions0.14.0+dfsg-1Source reference:
/affected/0/versions0.14.0+dfsg-2Source reference:
/affected/0/versions0.15.0+dfsg-1Source reference:
/affected/0/versions0.16.1+dfsg-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
shaarli
Source reference: /affected/1/package/name
- Affected versions
- 0.14.0+dfsg-1
Source reference:
/affected/1/versions0.14.0+dfsg-2Source reference:
/affected/1/versions0.14.0+dfsg-2+deb13u1Source reference:
/affected/1/versions0.15.0+dfsg-1Source reference:
/affected/1/versions0.16.1+dfsg-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "shaarli",
"purl": "pkg:deb/debian/shaarli?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"0.12.1+dfsg-8",
"0.12.1+dfsg-8+deb12u1",
"0.12.1+dfsg-8+deb12u2",
"0.13.0+dfsg-1",
"0.13.0+dfsg-2",
"0.13.0+dfsg-3",
"0.13.0+dfsg-4",
"0.13.0+dfsg-5",
"0.14.0+dfsg-1",
"0.14.0+dfsg-2",
"0.15.0+dfsg-1",
"0.16.1+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48823.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "shaarli",
"purl": "pkg:deb/debian/shaarli?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.14.0+dfsg-1",
"0.14.0+dfsg-2",
"0.14.0+dfsg-2+deb13u1",
"0.15.0+dfsg-1",
"0.16.1+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48823.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57189 · Revision 1
- Added to Heist Feed
- Publisher date