CVE-2026-48822 Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links
An authenticated user can inject malicious JavaScript via Markdown reference links in bookmark descriptions, leading to stored XSS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-48822?
CVE-2026-48822 is a medium-severity cross-site scripting vulnerability in Shaarli, published on 17 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown link. The vulnerability originates in the filterProtocols method within BookmarkMarkdownFormatter.php.This method attempts to sanitize Markdown links by filtering dangerous protocols (such as javascript:) before rendering. It uses the following regular expression: (#]\((.*?)\)#is). This regex is designed to detect inline Markdown links, but it fails to detect Markdown reference-style links because reference-style links are resolved by the Markdown parser after preprocessing. The filterProtocols method never inspects the actual URL used in these references and as a result, an attacker can supply a javascript: URI inside a reference definition. This issue has been fixed in version 0.16.2.
Weakness: CWE-79
Which versions are affected by CVE-2026-48822?
How do I fix CVE-2026-48822?
No fix has been published for CVE-2026-48822 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-48822 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48822 exists.
Sources
Also known as DEBIAN-CVE-2026-48822, GHSA-2hgr-63wv-x462, UBUNTU-CVE-2026-48822.