The vulnerability allows an attacker to inject arbitrary HTML through a tag that begins with a double quote. This prematurely closes the input element on the start page, enabling the injection of malicious code and resulting in a stored cross-site scripting flaw. The weakness a classic input validation failure identified as CWE‑79. Attackers who can create or edit tags can embed scripts that execute in the browsers of anyone who views the affected page, potentially compromising account credentials or performing session hijacking, thereby affecting confidentiality and integrity of the system. The impact scope covers all users who access the blogging or bookmarking interface, potentially rendering the service unusable for legitimate visitors.

Shaarli personal bookmarking service versions older than 0.16.0. All installations prior to this release, regardless of deployment environment, are susceptible as they lack the input sanitization fix introduced in 0.16.0.

The CVSS v3 score of 5.3 indicates moderate severity, while the EPSS value of less than 1% suggests low current exploit probability. The vulnerability is not listed in the CISA KEV catalog, implying it is not actively exploited in the wild. The likely attack vector involves an attacker creating a malicious tag via the suggested tags feature; this requires write access to tag data. Once injected, the payload is stored and delivered to subsequent users who view the page, making it a classic stored XSS scenario.