Read the docs
TI-2026-84450 Aliases CVE-2026-121627GHSA-jx74-jhpj-pc7p

Stored cross-site scripting in buku bookmark list via bookmark URL

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

buku from 5.0 through 5.1.1 contains a stored cross-site scripting flaw in the bukuserver bookmark list, because bookmark URLs are not escaped when rendered (CWE-79). An unauthenticated remote attacker can store a crafted bookmark URL through the bookmarks API, so script runs in the browser of users who view the list. That script can send same-origin API requests using the viewer's credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.

Why it matters now

EPSS 0.00194 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jarunbuku5.0 – 5.1.1—No fix listedCNA
  • buku Vendorjarun Affected 5.0 – 5.1.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for buku.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121627
  2. 2026-11-03 Alias added: GHSA-jx74-jhpj-pc7p
  3. 2026-11-04 Affected versions changed · Red Hat
  4. 2026-11-04 CVSS score added · Red Hat

References

Other 3

  • TI-2026-84354 OS command injection in nnn togglex plugin via crafted filenames CVSS 4.0HIGH 8.4
  • TI-2026-84355 nnn Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins CVSS 4.0MEDIUM 4.1
  • TI-2026-85580 Server-side request forgery in Buku bukuserver reaches internal hosts CVSS 4.0MEDIUM 6.3
  • TI-2025-12396 jarun nnn nnn.c run_cmd_as_plugin double free CVSS 4.0MEDIUM 4.8
  • TI-2026-84356 Symlink-following write in nnn via NNN_FIFO handling CVSS 4.0LOW 1.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences