Executive brief
RuoYi, a popular management system framework, contains a security flaw in its notification and announcement module. An attacker with basic user permissions can create a malicious announcement that executes hidden code in the browsers of other users, including administrators. This could allow the attacker to perform unauthorized actions, such as creating new administrator accounts or stealing sensitive session information, potentially leading to a full takeover of the system.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in RuoYi versions 4.8.2 and 4.8.3 within the '/system/notice/add' interface. The vulnerability stems from the 'application.yml' configuration explicitly excluding the notice module from the XSS filter to support the Summernote rich text editor. Because the backend 'SysNoticeController' fails to perform server-side HTML sanitization (e.g., using Jsoup) and the frontend 'view.html' uses 'th:utext' to render raw HTML, an attacker with 'system:notice:add' permissions can inject malicious scripts. When combined with the application's disabled CSRF protection, this can be used to perform administrative actions, such as creating backdoor accounts, when an administrator views the malicious notice. Developers are advised to implement HTML sanitization using a library like Jsoup with a relaxed safelist in the 'addSave' and 'editSave' methods.
Affected products
- yangzongzhuan RuoYi 4.8.2, 4.8.3
Timeline
- 2026-04-20: disclosed: Issue reported on GitHub repository
- 2026-06-15: advisory: CVE-2026-37216 published by NVD