{"id":"CVE-2026-104587","title":"blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability","summary":"blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"published":"2026-10-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:56:15.773","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104587","references":[{"url":"https://github.com/AmalJafarzade/CVE-2026-104587","label":"cve@mitre.org"},{"url":"https://github.com/blob42/gosuki","label":"cve@mitre.org"},{"url":"https://github.com/AmalJafarzade/CVE-2026-104587","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00205,"epssPercentile":0.10436,"exploits":{"github":1,"githubRepos":["https://github.com/AmalJafarzade/CVE-2026-104587"],"checkedAt":"2026-10-27T20:57:13.809Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T14:47:42.601854Z"},"ingestedAt":"2026-10-13T21:58:14.168Z","slug":"CVE-2026-104587","body":"## Overview\n\nblob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222404,"id":"CVE-2026-104587","ts":1792077088998,"field":"cvss","old":null,"new":"5.4"},{"seq":222403,"id":"CVE-2026-104587","ts":1792077088998,"field":"severity","old":"none","new":"medium"}]}