CVE-2026-104587 blob42 CVE debrief

Who should care

Defenders responsible for gosuki deployments should assess exposure and prioritize verification and remediation efforts, especially for systems using the affected commit. This includes reviewing and updating bookmarks.html to prevent exploitation and ensuring that appropriate security measures are in place to protect against potential JavaScript execution in the victim's browser context.

Why it matters

CVE-2026-104587 is a Stored Cross-Site Scripting (XSS) vulnerability in gosuki that allows an attacker to execute arbitrary JavaScript in the victim's browser context. Defenders should prioritize verifying the presence of this vulnerability in their deployments and assess exposure.

• Potential for arbitrary JavaScript execution in victim's browser context
• Possible impact on system security and data integrity
• Need for verification of affected versions and remediation
• Importance of updating bookmarks.html to prevent exploitation

Technical summary

The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface. This vulnerability allows for potential JavaScript execution in the victim's browser, impacting system security and data integrity. Defenders should prioritize verifying the presence of this vulnerability in their gosuki deployments and assess exposure, especially for systems using the affected commit.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their gosuki deployments and assess exposure, especially for systems using the affected commit.

Recommended defensive actions

• Verify the presence of this vulnerability in gosuki deployments
• Assess exposure, especially for systems using the affected commit
• Review and update bookmarks.html to use context-aware auto-escaping
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the record lacks specific information on exploitation, impact, or remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.