Severity by source
AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Stored XSS is network-delivered to victim browsers (AV:N); any authenticated account can plant the payload (PR:L); victim browser session constitutes a changed scope (S:C); no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionality of Shaarli. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark (Shaare). The malicious payload is stored and later executed when users interact with the "Filter by tag" search feature on the homepage. User-supplied input in the tags field is not properly sanitized or output-escaped before being rendered in the tag filtering interface. When a bookmark is created with a malicious payload inside the tag field, the payload is stored in the database. Later, when a user searches using the "Filter by tag" functionality on the homepage, the application renders matching tags dynamically. If the tag value contains HTML with JavaScript event handlers, it is injected into the DOM. This impacts anyone interacting with the "Filter by tag" search functionality, administrators and privileged users. This issue has been fixed in version 0.16.2.
AnalysisAI
Stored XSS in Shaarli's tag filtering functionality permits an authenticated user to inject persistent JavaScript payloads via the bookmark tags field, which execute in the browsers of any user who subsequently interacts with the 'Filter by tag' search feature on the homepage. All Shaarli deployments running version 0.16.1 or earlier are affected, including instances where administrators use the tag-filter feature. The vulnerability enables session hijacking or credential exfiltration against any user who triggers the tag search, with no public exploit code or CISA KEV listing identified at time of analysis. Vendor-released patch v0.16.2 (2026-05-23) resolves the issue.
Technical ContextAI
Shaarli is a self-hosted PHP bookmarking application (CPE: cpe:2.3:a:shaarli:shaarli:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored variant. Tag values submitted during bookmark (Shaare) creation were persisted to the database without sanitization. The v0.16.2 changelog confirms the fix targeted 'encode tag text in Awesomplete autocomplete suggestions,' revealing that the Awesomplete JavaScript autocomplete library was the injection sink: tag values were passed unsanitized into Awesomplete's suggestion rendering, which injected them into the DOM without HTML encoding. HTML elements with JavaScript event handlers in a tag value (e.g., onmouseover) would therefore execute when users hovered over or clicked autocomplete suggestions in the 'Filter by tag' interface. The same release also patched related XSS vectors in Markdown href sanitization and thumbnail DOM insertions.
RemediationAI
Upgrade to Shaarli v0.16.2, released 2026-05-23, which resolves this vulnerability by encoding tag text in Awesomplete autocomplete suggestions and applies additional XSS fixes for Markdown href sanitization and thumbnail DOM insertions. The patched release is available at https://github.com/shaarli/Shaarli/releases/tag/v0.16.2. Prior to patching, administrators can reduce exposure by restricting bookmark creation to a minimal set of fully trusted accounts, as unauthenticated users cannot plant the payload; however, this limits core application functionality. Placing the Shaarli instance behind a VPN or IP allowlist to eliminate public network access removes the network delivery vector entirely with no functional trade-off for personal deployments. Disabling the 'Filter by tag' feature via template modification would prevent payload execution but would break a core search workflow.
Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code
Stored XSS in Shaarli versions before 0.16.0 allows authenticated attackers to inject malicious HTML by crafting tags st
Stored XSS in Shaarli versions prior to 0.16.3 enables administrator account takeover through a low-effort social engine
Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags
Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to injec
DOM-based XSS in Shaarli's Thumbnail Synchronizer allows stored malicious bookmark titles to execute arbitrary JavaScrip
Stored XSS in Shaarli's Markdown rendering pipeline (versions 0.16.1 and prior) allows an authenticated user to inject m
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today