Newbiefromcoma

**Name of the Vulnerable Software and Affected Versions** Shaarli versions prior to 0.16.2 **Description** A stored Cross-Site Scripting (XSS) issue exists in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown reference-style link. The problem occurs in the `filterProtocols()` function within `BookmarkMarkdownFormatter.php`, which uses a regular expression to sanitize links. This regex fails to detect reference-style links because they are resolved by the Markdown parser after preprocessing, allowing the `filterProtocols()` function to bypass the inspection of the actual URL used in these references. **Recommendations** Update to version 0.16.2.

**Name of the Vulnerable Software and Affected Versions** Shaarli versions prior to 0.16.2 **Description** A stored Cross-Site Scripting (XSS) issue exists in the tag filtering functionality. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark. Because user-supplied input in the tags field is not properly sanitized or output-escaped, the malicious payload is stored in the database and executed when users, including administrators and privileged users, interact with the "Filter by tag" search feature on the homepage. The application renders matching tags dynamically, allowing HTML with JavaScript event handlers to be injected into the DOM. **Recommendations** Update to version 0.16.2.

**Name of the Vulnerable Software and Affected Versions** Shaarli versions prior to 0.16.2 **Description** A DOM-based Cross-Site Scripting (XSS) issue exists in the Thumbnail Synchronizer feature. When an administrator executes the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted into the Document Object Model (DOM) using `innerHTML` without proper sanitization. This occurs because the `ThumbnailsController::ajaxUpdate()` method returns bookmark data using the 'raw' formatter, which includes unescaped titles in the JSON response. The client-side script `thumbnails-update.js` then processes this response to update the progress interface. Exploitation can lead to session hijacking, privilege escalation, backdoor injection, and full system compromise. **Recommendations** Update to version 0.16.2.