Executive brief
litemall is an open-source e-commerce platform with a Spring Boot backend and Vue.js admin interface. A vulnerability allows users with topic editing permissions (such as the "Promotion Admin" role) to inject malicious HTML into topic descriptions without proper validation. When public topic pages are viewed by other users, the injected scripts execute in their browsers, potentially allowing attackers to steal session data, modify page content, or perform actions on behalf of victims.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Admin Topic management feature. The `AdminTopicController.validate` method performs only a non-null check on the `topic.content` field before persisting it via `topicService.add/updateById`, without sanitizing HTML or JavaScript. The public topic detail endpoint (`GET /wx/topic/detail?id=...`) returns the unsanitized content to unauthenticated users, and the client-side Vue template (`litemall-vue/src/views/items/topic/index.vue`) renders it using `v-html`, directly executing any injected scripts. An attacker with low-privilege role permissions (e.g., Promotion Admin) can inject malicious payloads that affect other users viewing the same topic. No patch is currently available; the vulnerability remains open on the project's issue tracker as of the advisory date.
Affected products
- linlinjava litemall 1.5.0, 1.6.0, 1.7.0, 1.8.0 and current master branch
Timeline
- 2026-09-13: disclosed: CVE-2026-90569 published
- 2026-08-01: other: Vulnerability reported to project via Gitee issue #IK5SUU