CVE-2026-104587

Deferred Deferred - Pending Action

Stored XSS in blob42 gosuki Bookmark URL Handling

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: MITRE

Description

blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104587

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in blob42 gosuki. The application fails to properly escape user input in bookmark URLs due to using text/template instead of html/template. Attackers can inject malicious scripts via crafted URLs that execute when viewed in the web interface.

Detection Guidance

To detect this vulnerability, inspect the application's bookmark handling in internal/webui/templates/bookmarks.html. Check if the application uses text/template instead of html/template for rendering URLs. Look for improper escaping of URL and DisplayURL fields that could allow XSS payloads.

Impact Analysis

An attacker could trick you into clicking a malicious bookmark link, allowing them to steal session cookies, perform actions on your behalf, or spy on your activity within the application. This could lead to unauthorized access to your data or account.

Compliance Impact

This vulnerability could violate GDPR by exposing user data through XSS attacks. For HIPAA, it may compromise protected health information if exploited. Organizations may face compliance violations, fines, or reputational damage if this flaw is not addressed.

Mitigation Strategies

Immediately update the application to use html/template for rendering URLs instead of text/template. Review all bookmark URLs for malicious payloads and remove any suspicious entries. Apply input validation to sanitize URLs before storage.

Hi! I’m here to help you understand CVE-2026-104587. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70