The blob42 gosuki application stores user bookmarks and renders them in the web UI using Go’s text/template engine instead of the safer html/template engine. Because the URL and DisplayURL fields are not context‑aware escaped, attackers can embed malicious JavaScript inside a bookmark URL that causes arbitrary code to run in a victim’s browser when the bookmark list is rendered. This stored XSS flaw can lead to session hijacking, credential theft, or further exploitation within the victim’s environment. It is an example of an input validation and output encoding weakness.

The vulnerability is present in the blob42 gosuki bookmark manager. No specific product versions are listed, and the flaw resides in the internal/webui/templates/bookmarks.html template used by the application.

The EPSS score is reported as less than 1%, indicating a low, though not zero, likelihood of public exploitation. The flaw is not listed in the CISA KEV catalog. An attacker must inject a malicious bookmark into the system; a user who subsequently visits the web UI will trigger the script. Because the attack requires a vulnerable instance and a victim who opens the page, the overall risk is moderate until a patch is applied. The vulnerability can be exploited directly through the application’s input for bookmarks, so it is an in‑application attack vector.