LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered verbatim as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue.

LinkAce, a self-hosted link archiving application, contains a stored Cross-Site Scripting (XSS) vulnerability prior to version 2.5.7. The Bulk Link API endpoint (POST /api/v2/bulk/links) fails to validate URL formats, allowing authenticated users to store malicious javascript: URIs. These URIs are rendered verbatim as href attributes in Blade templates, meaning any user who clicks the link executes arbitrary JavaScript in their browser. This can lead to cookie and session token exfiltration, enabling session hijacking. The vulnerability requires authentication to exploit but can target other users of the same instance. The issue has been patched in LinkAce version 2.5.7, with the fix available via a GitHub commit. A GitHub Security Advisory (GHSA-6r73-pchm-4m39) has also been published.