CVE-2026-121627

MEDIUM 6.1

buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.

CWE	CWE-79
Vendor	jarun
Product	buku
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for jarun buku

Be the first to know when new medium vulnerabilities affecting jarun buku are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

jarun / buku

5.0 ≤ 5.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jarun/buku/issues/911 github.com: https://github.com/jarun/buku/blob/v5.1.1/bukuserver/views.py#L133 github.com: https://github.com/jarun/buku vulncheck.com: https://www.vulncheck.com/advisories/buku-5.0-through-5.1.1-stored-xss-via-bukuserver-bookmark-list-url

Credits

George Chen