CVE-2026-49436

Received Received - Intake

Stored XSS via Unvalidated javascript: URI in LinkAce

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered verbatim as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-49436

Affected Vendors & Products

Vendor	Product	Version / Range
linkace	linkace	to 2.5.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

LinkAce before version 2.5.7 has a vulnerability in its Bulk Link API endpoint where it accepts URLs without validation. This allows an authenticated user to store a javascript: URI, which is later rendered as an href in Blade templates. When clicked, it executes arbitrary JavaScript in the victim's browser, potentially stealing cookies and session tokens.

Detection Guidance

Check LinkAce instances for unauthenticated users storing javascript: URIs in the Bulk Link API endpoint. Inspect network traffic for POST requests to /api/v2/bulk/links containing javascript: URLs. Review stored links for suspicious javascript: entries in the database.

Impact Analysis

This vulnerability allows an attacker to execute malicious JavaScript in your browser when you interact with a crafted link. This could lead to theft of sensitive data like cookies and session tokens, enabling account takeover or further attacks on your system.

Compliance Impact

This vulnerability could lead to unauthorized JavaScript execution in a user's browser, potentially allowing attackers to exfiltrate sensitive data such as session tokens or cookies. This may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information) if user data is compromised.

Mitigation Strategies

Upgrade LinkAce to version 2.5.7 or later to apply the fix. If upgrading is not immediately possible, restrict access to the Bulk Link API endpoint to trusted users only and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-49436. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70