Executive brief
Shiyi-blog is a Vue and SpringBoot-based blogging platform with integrated chat functionality. A logged-in user can inject malicious JavaScript through the chat message endpoint, which is then stored in the database and rendered unsafely (via Vue's v-html) to other users viewing the chat history or receiving real-time messages, allowing attackers to steal session data or perform unauthorized actions on behalf of victims.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the chat message handling flow. An authenticated user submits malicious HTML/JavaScript via POST /chat/sendMsg; the ChatServiceImpl persists the content to the chat_msg table without sanitization. The frontend (chat/index.vue) then renders message content using Vue's v-html directive, which interprets the content as raw HTML. Since SysChatMsgMapper.getChatMsgList returns all global chat history without filtering and WebSocketServer broadcasts to all connected sessions, any logged-in user viewing the chat page is vulnerable to code execution. The attack requires prior authentication but can target cross-user scenarios. Current patches include only sensitive-word filtering on the backend, which does not prevent XSS; proper fixes require disabling raw HTML rendering or applying a robust HTML sanitizer at the output boundary.
Affected products
- quequnlong shiyi-blog 1.0.0 to 1.2.1
Timeline
- 2026-09-13: disclosed
- other: Vulnerability reported via Gitee issue IK5RVL on 2026-08-01; project has not responded