gosuki EUVD-2026-100713

Exploitation requires that an attacker-controlled bookmark (specifically a crafted URL or DisplayURL value containing an HTML attribute-breaking payload) be stored in gosuki and then rendered by the vulnerable internal/webui/templates/bookmarks.html page, which uses Go's text/template (no context-aware auto-escaping) instead of html/template. LIMITING FACTORS: the attacker needs the ability to inject/store a bookmark (CVSS PR:L implies low-privilege authenticated access to the local interface), the victim must actually view the bookmarks page in a browser (UI:R), and the impact is confined to the victim's browser session (S:C, C:L/I:L, no availability impact). Because gosuki is a locally hosted, typically single-user bookmark/sync tool, realistic risk depends on whether untrusted bookmark data (e.g., synced or shared bookmarks) can reach the interface rendered to another user.

This is a moderate-severity stored XSS (CVSS 5.4, CWE-79) with signals that collectively point to LOW real-world urgency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation but requires some privilege (PR:L - authentication requirements per the vector are authenticated/low-privilege) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in the victim's browser context rather than the server's. EPSS is low at 0.23% (13th percentile), the CVE is NOT on CISA KEV, and no vendor-confirmed exploit flag was supplied. Per precision rules with no KEV and no explicit POC flag in the input, exploitation status is 'no public exploit identified at time of analysis'; HOWEVER, a dedicated researcher repository (github.com/AmalJafarzade/CVE-2026-104587) is referenced and very likely contains a proof-of-concept or write-up - this should be verified, as it may raise effective POC availability. No SSVC decision data was provided. Overall: signals are internally consistent (low EPSS, no KEV, moderate CVSS, privilege+interaction gating), so this is a genuine-but-low-priority defect, not a high-urgency threat - characteristic of a self-hosted, single-user local tool rather than mass-exploitable infrastructure.

An attacker crafts a bookmark whose URL or DisplayURL field embeds an HTML attribute-breaking payload (e.g., breaking out of an href attribute to inject an event handler). When this malicious bookmark is stored and later rendered in gosuki's local web interface, the text/template engine emits it without context-aware escaping, and the victim's browser executes the attacker's JavaScript in the session context of the local UI. A likely proof-of-concept exists in the referenced researcher GitHub repository, though it is not independently confirmed here.