CVE-2026-121627

buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

5.3 Medium

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.19%Unchanged since Nov 4, 2026

What each source reports

CVE List Score used 5.3

buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

Record: CVE-2026-121627
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-03

EUVDEUVD-2026-116102 5.3

Record: EUVD-2026-116102
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jx74-jhpj-pc7p 5.3

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver...

Record: GHSA-jx74-jhpj-pc7p
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-03

NVD 5.3

Record: CVE-2026-121627
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-03

OSV 5.3

buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

Record: CVE-2026-121627
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-05

OSVUBUNTU-CVE-2026-121627 5.3

Record: UBUNTU-CVE-2026-121627
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-05

Affected products

jarun buku

Affected packages

Affected packages
Package	Affected	Fixed
`buku` Ubuntu:18.04:LTS	All versions, plus listed versions 3.2.0-13.4.0-13.5.0-13.6-13.7-1	None known
`buku` Ubuntu:20.04:LTS	All versions, plus listed versions 4.2.2+ds-14.2.2+ds-24.3+ds-1	None known
`buku` Ubuntu:22.04:LTS	All versions, plus listed versions 4.6+ds-1	None known
`buku` Ubuntu:24.04:LTS	All versions, plus listed versions 4.8+ds-1	None known
`buku` Ubuntu:26.10	All versions, plus listed versions 5.0+ds-15.1.1+ds-2	None known
`buku` Ubuntu:26.04:LTS	All versions, plus listed versions 4.9+ds-15.0+ds-1	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	affected, aliases, references	OSV
Nov 4, 2026	references	OSV
Nov 3, 2026	published	EUVD
Nov 3, 2026	published	EUVD, NVD
Nov 3, 2026	aliases, cwes, references, severity, title	CVE List, GitHub Advisories
Nov 3, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-121627 is a medium vulnerability (CVSS 5.3) in Jarun Buku, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. No source names a fixed version.