Threats affecting pkg:pypi/buku

Buku versions 5.0 through 5.1.1 contain a stored cross-site scripting (XSS) vulnerability in the bukuserver bookmark list. This flaw allows attackers to inject malicious scripts via an unescaped bookmark URL, which can be submitted through the unauthenticated /api/bookmarks endpoint. Exploitation enables attackers to execute scripts in the context of the victim's browser, potentially issuing same-origin API requests with the victim's credentials.