Live › vulnerability › CVE-2026-121627
Buku is a command-line bookmark manager, and its bukuserver web interface fails to escape bookmark URLs in the bookmark list. An attacker who submits a crafted bookmark URL through the unauthenticated /api/bookmarks endpoint can run script in a viewer's browser and make same-origin API requests using that viewer's credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:22 UTC. All times on this page are UTC.
Deployments that run the bukuserver web interface for buku in versions 5.0 through 5.1.1 are exposed, because the bookmark list renders attacker-supplied URLs without escaping. Command-line-only use of buku does not render the list and is not described as affected. Teams that do not expose bukuserver can likely skip it.
No product ranges from the sources yet.
buku --version or pip show buku; the flaw affects versions 5.0 through 5.1.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-121627")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.