The vulnerability occurs when the bookmark title is inserted into the page <title> without escaping. An attacker can embed a payload such as </title><script>…</script> so that the script runs in the browser of any user who opens the public permalink. As the code executes under the Shaarli origin, this can lead to credential theft, session hijacking, or a complete administrator takeover.

Shaarli personal bookmarking service. All releases older than 0.16.3 are vulnerable. Administrators using an older installation are affected.

The CVSS score is 8.6, indicating high severity. EPSS data is not available, and the CVE is not listed in the KEV catalog. Exploitation requires an attacker to get an administrator to bookmark a URL containing the malicious title, which is then stored and rendered in the public permalink. Because the payload runs automatically on first visitation, the risk is that the attack can be triggered with a single subsequent access by any visitor, including the legitimate administrator, leading to a one‑shot takeover. The attack vector is a stored web‑based XSS that can be triggered by accessing a public URL.