CVE-2026-24476: Shaarli vulnerable to stored XSS via Suggested Tags
Published Jan 26, 2026
·Updated
Shaarli is a personal bookmarking service. Prior to version 0.16.0, crafting a malicious tag which starting with " prematurely ends the <input> tag on the start page and allows an attacker to add arbitrary html leading to a possible XSS attack. Version 0.16.0 fixes the issue.
Affected Software
2 affected components
Shaarli Shaarli<0.16.0
Shaarli Project Shaarli<0.16.0
Remediation
Event History
Jan 26, 2026
CVE Published
via MITRE·10:26 PM
Data Sourced
via MITRE·10:26 PM
DescriptionWeakness
Data Sourced
via NVD·11:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 27, 58104
Event
via FIRST·08:57 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-24476?
CVE-2026-24476 has a high severity rating due to the potential for stored XSS attacks.
2
How do I fix CVE-2026-24476?
To fix CVE-2026-24476, upgrade to Shaarli version 0.16.0 or later.
3
What is the impact of CVE-2026-24476?
The impact of CVE-2026-24476 includes the ability for attackers to execute arbitrary HTML and JavaScript in the context of the user’s session.
4
Which versions of Shaarli are affected by CVE-2026-24476?
CVE-2026-24476 affects Shaarli versions prior to 0.16.0.
5
Is CVE-2026-24476 a critical vulnerability?
Yes, CVE-2026-24476 is considered critical as it allows for potential XSS attacks that can compromise user data.