Is CVE-2026-90569 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90569 being exploited in the wild.

How severe is CVE-2026-90569?

Low severity, with a CVSS score of 2.4, published 13 September 2026.

Which products and versions are affected?

Linlinjava Litemall 1.5.0, 1.6.0, 1.7.0, 1.8.0 and current master branch.

Is there a fix for CVE-2026-90569?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90569 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90569?

Check whether you run Linlinjava Litemall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90569: linlinjava litemall stored XSS in topic content

CVE-2026-90569 · Severity: low · CVSS 2.4 · Published 2026-09-13

litemall is an open-source e-commerce platform with a Spring Boot backend and Vue.js admin interface. A vulnerability allows users with topic editing permissions (such as the "Promotion Admin" role) to inject malicious HTML into topic descriptions without proper validation. When public topic pages are viewed by other users, the injected scripts execute in their browsers, potentially allowing attackers to steal session data, modify page content, or perform actions on behalf of victims.

Technologies: Linlinjava Litemall. Vendors: Linlinjava.

Quick answers

Is CVE-2026-90569 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90569 being exploited in the wild.
How severe is CVE-2026-90569?: Low severity, with a CVSS score of 2.4, published 13 September 2026.
Which products and versions are affected?: Linlinjava Litemall 1.5.0, 1.6.0, 1.7.0, 1.8.0 and current master branch.
Is there a fix for CVE-2026-90569?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90569 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90569?: Check whether you run Linlinjava Litemall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Admin Topic management feature. The `AdminTopicController.validate` method performs only a non-null check on the `topic.content` field before persisting it via `topicService.add/updateById`, without sanitizing HTML or JavaScript. The public topic detail endpoint (`GET /wx/topic/detail?id=...`) returns the unsanitized content to unauthenticated users, and the client-side Vue template (`litemall-vue/src/views/items/topic/index.vue`) renders it using `v-html`, directly executing any injected scripts. An attacker with low-privilege role permissions (e.g., Promotion Admin) can inject malicious payloads that affect other users viewing the same topic. No patch is currently available; the vulnerability remains open on the project's issue tracker as of the advisory date.

Affected products

linlinjava litemall 1.5.0, 1.6.0, 1.7.0, 1.8.0 and current master branch

Timeline

2026-09-13: disclosed: CVE-2026-90569 published
2026-08-01: other: Vulnerability reported to project via Gitee issue #IK5SUU

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.