Shaarli’s Markdown-to-HTML conversion process contains a stored Cross‑Site Scripting flaw that arises when the filterProtocols method fails to sanitize reference‑style Markdown links. An authenticated user can inject a malicious "javascript:" URI into a bookmark’s description field; the Markdown parser later resolves this reference and delivers the payload to any user who views the bookmark. When executed in the victim’s browser, the attacker could potentially steal session data, perform account hijacking, or inject arbitrary UI changes. These impacts are inferred from typical XSS vectors and are not explicitly stated in the vendor description.

The vulnerability affects the Shaarli bookmarking application, specifically any installation using version 0.16.1 or earlier. Versions certified as 0.16.2 and later contain the necessary fix, so upgrading is a direct remediation path.

The CVSS score of 5.8 indicates a moderate severity. The EPSS score is less than 1 %, suggesting that, as of now, the probability of exploitation is low and no known public exploits are linked to this CVE. The vulnerability is not listed in the CISA KEV catalog. Exploitation is confined to authenticated users who can create or edit bookmarks; once a malicious bookmark is published, all users who view it are at risk. Given the limited attack surface and low exploitation likelihood, the overall risk is moderate, but the impact remains significant if compromised.