CVE-2026-24476: 
NixOS vulnerability analysis and mitigation

CVE-2026-24476 is a stored Cross-Site Scripting (XSS) vulnerability in Shaarli, a personal bookmarking service, affecting all versions prior to 0.16.0. An authenticated attacker with low privileges can craft a malicious tag beginning with a double-quote character (") that prematurely terminates an HTML <input> tag on the start page, enabling injection of arbitrary HTML and JavaScript. The advisory was published on January 23, 2026, and the fix was released in version 0.16.0. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is improper neutralization of user-controlled input during web page generation (CWE-79). Shaarli's template files rendered tag names directly into HTML data-list attributes without escaping, meaning a tag value starting with " would break out of the attribute context and allow injection of arbitrary HTML. The fix applied |escape filters to tag key output across multiple template files (addlink.html, editlink.html, linklist.html, page.header.html, tag.cloud.html, tag.list.html, and their vintage equivalents), ensuring special characters are HTML-encoded before rendering (GitHub Commit). A concrete proof-of-concept involves adding a tag such as "alert("XSS") to any note or link, which causes the tag suggestion input on /admin/add-shaare to be prematurely closed, injecting executable script content (GitHub Advisory). An alternative attack vector involves tricking a user into importing a malicious Netscape-style bookmarks file containing the crafted tag.

Successful exploitation allows an authenticated attacker to persistently inject arbitrary HTML and JavaScript into pages viewed by other users of the Shaarli instance. This can result in session cookie theft, credential harvesting, or performing unauthorized actions on behalf of victims who visit the affected pages. Confidentiality and integrity are both impacted at a low level under CVSS v3.1 scoring, with no availability impact; however, session compromise could lead to full account takeover within the application (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, including a screen recording demonstrating the attack. Exploitation requires an authenticated account with at least low privileges and user interaction (a victim must visit the page rendering the malicious tag). There is no evidence of active in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.02% (0.000200), indicating a very low probability of exploitation in the near term (GitHub Advisory).

1. Gain authenticated access: Log in to a Shaarli instance running a version prior to 0.16.0 with any account that has permission to create bookmarks or notes.
2. Craft a malicious tag: Create a new bookmark or note and assign it a tag that begins with a double-quote followed by an XSS payload, for example: " onmouseover=alert('XSS') data-x=" or "alert("XSS").
3. Alternative delivery via bookmark import: Craft a Netscape-style bookmarks HTML file containing a link with the malicious tag value and trick an administrator into importing it via Shaarli's import feature.
4. Trigger rendering: The malicious tag is stored in Shaarli's data store and rendered unescaped into the data-list attribute of tag suggestion <input> elements on pages such as /admin/add-shaare, /, and tag cloud/list pages.
5. Victim interaction: When another user (or the same user) visits any page that renders the tag suggestion input, the injected HTML/JavaScript executes in their browser context, enabling session cookie theft, credential harvesting, or other malicious actions (GitHub Advisory).

• Logs: Web server access logs showing requests to /admin/add-shaare, /, /tag-cloud, or /tag-list pages from unexpected users or at unusual times; log entries showing bookmark or tag creation with values containing ", <, >, or JavaScript keywords (alert, onerror, onmouseover, script).
• File System / Data Store: Shaarli's data file (typically data/datastore.php or similar) containing tag entries with embedded HTML special characters such as ", <script>, or event handler attributes.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from the Shaarli server's web origin; unusual POST requests to external URLs triggered from within the Shaarli application context.
• Application Behavior: Unexpected JavaScript alerts or redirects appearing on Shaarli pages for users browsing tag suggestion inputs (GitHub Advisory).

Upgrade Shaarli to version 0.16.0 or later, which applies |escape HTML encoding to all tag key outputs in template files, preventing attribute breakout (GitHub Commit). If immediate patching is not possible, restrict bookmark and tag creation permissions to trusted users only, and audit existing tags in the data store for suspicious entries containing quotation marks or HTML characters. Deploying a Web Application Firewall (WAF) with XSS detection rules can provide additional defense-in-depth while patching is pending (GitHub Advisory).

The vulnerability was reported by researcher mowoe and published as a GitHub Security Advisory by the Shaarli maintainer nodiscc on January 23, 2026. A Debian Security Advisory (DSA-6128-1) was subsequently issued, and Tenable released Nessus detection plugins (IDs 296741 and 298402) for the vulnerability. Coverage was noted on security aggregation sites including LinuxSecurity.com and infinitsec.net, with no significant broader media or social media controversy observed (GitHub Advisory, Tenable).