CVE-2026-121627 in buku
Summary
by MITRE • 11/03/2026
buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Buku versions 5.0 through 5.1.1 represents a critical stored cross-site scripting flaw located within the bukuserver bookmark management interface. This security defect arises from insufficient input validation and output encoding mechanisms when handling user-supplied data, specifically targeting the BookmarkModelView._list_entry() function. The core technical issue lies in the application's failure to properly sanitize or encode special characters, particularly double quotes and event handler attributes, before rendering them within the HTML context of the bookmark list view. Because this is a stored vulnerability, malicious payloads are persisted on the server side rather than being transiently passed via URL parameters, ensuring that every user who accesses the affected page will execute the injected script without requiring further interaction from the attacker beyond the initial submission.
The attack vector exploits the unauthenticated /api/bookmarks endpoint to inject a crafted bookmark entry containing a malicious URL payload. By submitting a URL string that includes HTML event handlers such as onerror or onload wrapped in double quotes, an attacker can bypass basic filtering and embed executable JavaScript code directly into the database records. When the application subsequently retrieves this data to render the bookmark list for any user, it outputs the raw, unescaped content into the DOM. This allows the malicious script to execute within the security context of the victim's browser session. The persistence of this payload means that the vulnerability remains active until the compromised record is manually deleted or sanitized by an administrator, creating a long-term risk vector against all users with access to the bookmark list interface.
The operational impact of this vulnerability extends beyond simple script execution, as it enables sophisticated attacks leveraging same-origin policy violations. Since the injected scripts run in the context of the application's domain, they possess full access to session cookies, local storage, and other sensitive data associated with that origin. Attackers can utilize these capabilities to issue authenticated API requests on behalf of legitimate users, effectively hijacking their sessions. This capability allows for unauthorized actions such as modifying bookmarks, exfiltrating stored credentials or personal information contained within bookmark metadata, and potentially escalating privileges if the victim holds administrative rights. The ability to perform same-origin API calls significantly amplifies the severity, transforming a standard XSS flaw into a mechanism for complete account takeover and data theft.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under stored or persistent cross-site scripting where the malicious payload is saved on target servers. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution within a browser environment. Furthermore, the ability to perform actions with user credentials relates to T1078, Valid Accounts, as it facilitates unauthorized access by stealing or impersonating valid session tokens. The lack of authentication required for the initial injection point also highlights weaknesses in input validation controls that should be enforced regardless of the caller's identity when handling data destined for HTML rendering contexts.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. For affected systems running versions 5.0 through 5.1.1, upgrading to a patched version where this issue has been resolved is the primary recommendation. In cases where an upgrade is not immediately feasible, administrators should manually inspect the bookmark database for entries containing suspicious URL patterns or HTML tags and remove them. Implementing strict output encoding using context-aware methods such as HTML entity encoding for all user-supplied data before rendering it in templates can prevent script execution. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking cross-site scripting payloads may provide an additional layer of defense against exploitation attempts while the underlying code is being corrected. Future development should prioritize implementing Content Security Policy headers to restrict inline script execution and enforce strict input validation on all API endpoints that accept user data for storage.