CVE-2026-121627: buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

Published Nov 3, 2026

Updated

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView.listentry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.

Event History

Nov 3, 2026

CVE Published

via MITRE·05:13 PM

Data Sourced

via MITRE·05:13 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments running buku versions 5.0 through 5.1.1 with bukuserver's bookmark list in use are affected. A user who views a malicious stored bookmark entry may have their browser execute the attacker-controlled script.

What does an attacker need to exploit it?

The attacker can submit a crafted bookmark URL to the unauthenticated /api/bookmarks endpoint. Exploitation also requires a victim to view the stored bookmark through the bookmark list.

What can the injected script do in a victim's browser?

The script can issue same-origin API requests using the credentials of the user viewing the malicious bookmark. The provided information identifies potential confidentiality and integrity impact, but no availability impact.

CVE-2026-121627: buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can the injected script do in a victim's browser?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can the injected script do in a victim's browser?