Description
buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jarun | buku | 5.0 – ≤ 5.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | buku | No fix yet | — |
| Ubuntu 26.04 LTS | buku | No fix yet | — |
| Ubuntu 24.04 LTS | buku | No fix yet | — |
| Ubuntu 22.04 LTS | buku | No fix yet | — |
| Ubuntu 20.04 LTS | buku | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | buku | No fix yet | — |
References
- GitHub Issue #911 issue-tracking
- https://github.com/jarun/buku/blob/v5.1.1/bukuserver/views.py#L133 technical-description
- https://github.com/jarun/buku product
- VulnCheck Advisory: buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL third-party-advisory