CVE-2026-50190

The vulnerability in BookmarkListController is a textbook stored XSS — but the metadata fetcher is what elevates this from a situational social-engineering problem to a point-and-shoot supply-chain weapon. In isolation, exploiting the XSS requires convincing an admin to manually paste a script tag into a bookmark title field. That's high-friction and detectable. The metadata fetcher removes that friction entirely: it treats the `<title>` tag from any remote page as trusted data and copies it directly into the template variable without sanitization. An attacker simply hosts a page with a malicious title and waits for the automated fetcher to deliver the payload on the admin's next save event. This changes the threat model fundamentally. The attack surface shifts from user-input hygiene to trust propagation — every URL the administrator bookmarks becomes a potential injection vector, and that elevation is permanent. The execution window is narrow (one-shot on save) but far more dangerous than typical stored XSS because it fires in an authenticated admin session with full privileges. The deeper issue is architectural: the metadata fetcher was written under narrower threat-model assumptions, before the template engine entered the picture, and nobody audited the junction where fetched content flows into template rendering. This is not an isolated failure — the same pattern has reproduced across Pinboard (2017), Wallabag (2019), and prior Shaarli CVEs. Each disclosure should have triggered ecosystem-wide retroactive audits; the nine-year gap before this patch represents systemic debt. The 0.16.3 fix presumably addresses the escaping in this instance, but the critical question is whether it treats fetched metadata as inherently untrusted input going forward — or just patches the symptom. Until fetched data is architecturally classified as user input for template purposes, future features (description fetchers, thumbnail fetchers, tag fetchers) will recreate this same chain. Audit any automated fetch-to-template pipeline in your deployment and treat all fetched content as untrusted regardless of origin.

Reviewed through automated stages and approved by a human before publication.