Executive brief
Shiyi-blog is a Vue + SpringBoot blogging platform with an admin dashboard for managing blog content and visitor interactions. A stored cross-site scripting (XSS) vulnerability in the message management feature allows unauthenticated attackers to inject malicious code into message submissions, which is then executed in the admin panel when managers review messages, potentially compromising administrative sessions and operations.
Technical details
The vulnerability is a stored XSS in the message submission API endpoint (`POST /api/message/add`). Unauthenticated attackers can submit malicious HTML/JavaScript in the `body.content` parameter. The backend applies only basic sensitive-word filtering before storing the content in the database. When administrators access the message management page in the admin dashboard, the frontend renders the stored content using Vue's `v-html` directive without sanitization, executing the attacker's script in the admin's browser context. The `/api/**` endpoints are explicitly excluded from Sa-Token authentication checks, so no credentials are required. Attack success depends on an admin viewing the messages page.
Affected products
- quequnlong shiyi-blog 1.0.0 to 1.2.1
Timeline
- 2026-08-01: disclosed: Vulnerability reported via Gitee issue IK5RF6
- 2026-09-13: advisory: CVE-2026-90527 published