buku CVE-2026-121627

Exploitation requires a running bukuserver instance (the optional web server component of buku, versions 5.0 through 5.1.1) that is reachable by the attacker; the injection point is the unauthenticated /api/bookmarks endpoint, so no attacker authentication is needed to plant the payload (PR:N). The concrete prerequisite is submitting a bookmark URL containing a double quote plus an HTML event handler, which is stored unescaped by BookmarkModelView._list_entry(). The key limiting factor is that payload execution depends on a separate victim with an active session viewing the bookmark list page (UI:P / passive interaction) - the attacker cannot self-trigger impact; the realized damage is bounded to same-origin API actions performed with that viewer's credentials.

This is a genuine but moderate-priority web vulnerability rather than a high-urgency emergency. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, base 5.3) is internally consistent with the description: the injection vector is the network-facing, unauthenticated /api/bookmarks endpoint (AV:N, PR:N, AT:N, AC:L), but exploitation is gated on a victim viewing the bookmark list (UI:P), and impact is limited to low confidentiality/integrity on both the vulnerable and a subsequent same-origin system (VC/VI:L, SC/SI:L) with no availability impact. This is a stored XSS that pivots into same-origin API abuse using the viewer's credentials, which is why the 4.0 vector correctly shows a subsequent-system impact rather than N. On exploitation signals the picture is quiet: the input provides no CISA KEV listing and no EPSS score, and no reference is labeled as confirmed working exploit code - the four references are the upstream GitHub issue (#911), the exact vulnerable source line (views.py#L133), the project repo, and the VulnCheck advisory. The vuln.today Decision label is 'this_month', not act_now/emergency, which aligns with a credible-but-not-actively-exploited server-side XSS. Net assessment: patch on a normal cadence (this month); the combination of an unauthenticated injection point plus the credential-borrowing impact raises it above a trivial self-XSS, but the required victim interaction, low technical impact, and absence of KEV/EPSS/confirmed exploit keep it out of drop-everything territory.

An attacker sends a crafted bookmark whose URL contains a double quote and an HTML event handler to the unauthenticated /api/bookmarks endpoint of a bukuserver instance. When a legitimate user later opens the bookmark list, the unescaped URL rendered by BookmarkModelView._list_entry() breaks out of its attribute and executes attacker script in the viewer's browser, issuing same-origin API requests with that viewer's credentials. No public exploit is identified at time of analysis, though the vulnerable code line and the mechanism are documented in the references.