Executive brief
NansBBS is an open-source forum platform that allows users to publish articles with Markdown content. A stored cross-site scripting (XSS) vulnerability exists in the article table of contents generation feature, allowing authenticated users to inject malicious scripts that execute when administrators review or readers view articles. This could result in session hijacking, credential theft, or unauthorized actions performed on behalf of affected users.
Technical details
The vulnerability is a stored XSS flaw in the ArticleController's table of contents generation logic (utils.toToc function in ArticleDetail.vue). When users create or update articles, they can submit both markdown and HTML fields; the backend saves the HTML field as-is to MongoDB without sanitization. During article display, the toToc utility extracts heading identifiers from the stored HTML and constructs a table of contents string using string concatenation with unencoded user-supplied data. This malicious content is then rendered unsafely using Vue's v-html directive in MarkdownToc.vue. The attack requires authentication to create/update articles but affects unauthenticated readers viewing published articles and administrators reviewing pending articles. No patched version is currently available.
Affected products
- maliangnansheng bbs-springboot 3.0.0
Timeline
- 2026-08-01: disclosed: GitHub Issue #38 opened
- 2026-09-13: advisory: CVE-2026-90563 published