A DOM‑based XSS flaw exists in Shaarli’s Thumbnail Synchronizer. When an administrator triggers the thumbnail update, the backend returns bookmark titles unescaped in a JSON payload that the client script injects into the page via innerHTML. Because the data is not sanitized, an attacker controlling a bookmark title can inject arbitrary script. Successful exploitation could allow an attacker to hijack the administrator’s session, elevate privileges, insert a backdoor, or fully compromise the web site. The weakness falls under CWE‑79.

The vulnerability affects the Shaarli bookmarking service, specifically version 0.16.1 and all earlier releases. Administrators who use the thumbnail synchronization feature in these releases are potentially exposed. The issue was resolved in Shaarli 0.16.2, which implements proper escaping of the bookmark title before it is rendered in the browser.

The CVSS score is 5.8, indicating moderate severity. The EPSS score is less than 1 %, showing a very low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrative access to the site to trigger the thumbnail synchronization, or the ability to supply a malicious bookmark title. Because the vector is limited to administrators, the overall risk to typical users is lower, but the impact for those with admin privileges remains significant.