blob42 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review blob42 CVE published 2026-10-13

CVE-2026-104587

CVE-2026-104587 is a Stored Cross-Site Scripting (XSS) vulnerability in blob42 gosuki through commit 6e2bf34. The application fails to perform context-aware auto-escaping on URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html, allowing an attacker to craft a malicious bookmark URL that executes arbitrary JavaScript in the victim's browser context when rendered in the local web interface.