CVE-2026-48822: Stored XSS in Shaarli Bookmark Markdown Processing

Technical summary

The vulnerability resides in the filterProtocols method of BookmarkMarkdownFormatter.php, which attempts to prevent XSS by detecting and blocking dangerous URI protocols in Markdown links before HTML rendering. The method uses a regular expression (#]\((.*?)\)#is) that successfully catches inline Markdown links (e.g., [text](url)), but fails to process reference-style links, which are resolved by the Markdown parser after the filterProtocols preprocessing step. An attacker can define a reference-style link with a javascript: URI—such as [ref]: javascript:alert(1)—and reference it elsewhere in the bookmark description. Since the method never validates the actual URLs in reference definitions, the malicious protocol reaches the HTML renderer and executes in the victim's browser. This is a classic case of incomplete input validation where one code path bypasses security checks.

Business impact

Authenticated users can deface or hijack the bookmarking experience of other users, capture credentials through fake login forms injected into bookmark pages, redirect users to malicious sites, or harvest session cookies. For organizations using Shaarli as a shared bookmarking tool, a compromised account or insider threat could inject persistent malware references across shared bookmark collections. The attack requires authentication and user interaction (clicking the malicious bookmark), limiting scope but not eliminating risk in collaborative environments where trust in fellow users may be assumed.

Affected systems

All installations of Shaarli version 0.16.1 and earlier are affected. The vulnerability is triggered only when an authenticated user creates or edits a bookmark with a malicious reference-style Markdown link in the description field. Self-hosted Shaarli instances and any deployment where multiple authenticated users share bookmark collections face the highest risk.

Exploitability

Exploitation requires valid authentication credentials and does not demand sophisticated techniques—a simple Markdown reference-style link definition is sufficient. However, the attack chain includes a critical dependency: the victim must view or interact with the malicious bookmark for the JavaScript to execute. The CVSS 3.1 score of 5.8 reflects this requirement for user interaction (UI:R) and local access (AV:L), combined with high impact on confidentiality and integrity. This is not a wormable or network-propagating vulnerability, and it cannot be exploited by unauthenticated users.

Remediation

Upgrade Shaarli to version 0.16.2 or later, which patches the filterProtocols method to detect and block dangerous protocols in both inline and reference-style Markdown links. Organizations unable to patch immediately should restrict bookmark editing permissions to trusted administrators only, disable Markdown rendering in the description field if feasible, or implement a content security policy (CSP) to restrict inline script execution as a defense-in-depth measure.

Patch guidance

Apply version 0.16.2 as soon as possible after validating compatibility with your deployment. The patch directly addresses the regex and reference-style link handling logic. Review release notes to confirm any configuration or backup steps required for your instance. Test the patch in a non-production environment first to ensure no disruption to existing bookmarks.

Detection guidance

Monitor Shaarli access logs for authenticated users modifying bookmarks, and inspect bookmark descriptions for Markdown reference-style link definitions that include dangerous protocols (javascript:, data:, vbscript:, etc.). A simple content search for patterns like [ref]: javascript: or similar constructs in bookmark JSON exports or database records can identify compromised bookmarks. Check browser console errors or CSP violation reports if CSP headers are in place, as they may indicate blocked malicious scripts.

Why prioritize this

While the CVSS score is moderate (5.8), the vulnerability should be prioritized based on deployment context. If Shaarli is used as a collaborative tool with multiple users, patch promptly because an insider threat or compromised account can poison shared resources. For single-user or low-trust-environment instances, the risk is lower, but patching remains advisable to close a known attack vector and reduce exposure to future copy-cat payloads or escalation tactics.

Risk score, explained

The CVSS 3.1 score of 5.8 (MEDIUM) reflects: (1) local attack vector (AV:L) because an attacker must authenticate; (2) low complexity (AC:L) because the attack requires only standard Markdown syntax; (3) high privilege required (PR:H) as authentication is mandatory; (4) required user interaction (UI:R) because the victim must view the bookmark; and (5) high confidentiality and integrity impact (C:H, I:H) because arbitrary JavaScript can read/modify page content and session state. Availability is not impacted (A:N). The score appropriately captures a contained but meaningful risk in collaborative or multi-user deployments.

Frequently asked questions