Threats affecting pkg:github/jarun/buku

Buku versions 5.0 through 5.1.1 have a stored cross-site scripting (XSS) vulnerability in the bukuserver bookmark list. This flaw allows attackers to inject malicious scripts via an unescaped bookmark URL submitted through the unauthenticated /api/bookmarks endpoint. Exploitation can lead to same-origin API requests executed with the viewer's credentials.