Is CVE-2026-90570 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90570 being exploited in the wild.

How severe is CVE-2026-90570?

Low severity, with a CVSS score of 2.4, published 13 September 2026.

Which products and versions are affected?

Linlinjava Litemall 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0 and current master.

Is there a fix for CVE-2026-90570?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90570 attacked?

It is attacked over the network.

Am I affected by CVE-2026-90570?

Check whether you run Linlinjava Litemall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90570: litemall stored XSS in product detail via v-html

CVE-2026-90570 · Severity: low · CVSS 2.4 · Published 2026-09-13

litemall is an open-source e-commerce platform that allows administrators to create and edit product details. An unvalidated product detail field is rendered as raw HTML on the public product page, allowing an attacker with product editing permissions to inject malicious scripts that execute in the browsers of any customer viewing that product. This can lead to theft of customer session data, account compromise, or malware distribution.

Technologies: Linlinjava Litemall. Vendors: Linlinjava.

Quick answers

Is CVE-2026-90570 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90570 being exploited in the wild.
How severe is CVE-2026-90570?: Low severity, with a CVSS score of 2.4, published 13 September 2026.
Which products and versions are affected?: Linlinjava Litemall 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0 and current master.
Is there a fix for CVE-2026-90570?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90570 attacked?: It is attacked over the network.
Am I affected by CVE-2026-90570?: Check whether you run Linlinjava Litemall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in litemall versions 1.4.0 through 1.8.0 and current master. The vulnerability exists in the product detail flow: the AdminGoodsService.validate() method does not sanitize the goods.detail field when processing POST /admin/goods/create or /admin/goods/update requests (which require admin:goods:create or admin:goods:update permission). The unsanitized detail is persisted to the database and later served by GET /wx/goods/detail without escaping. The public-facing Vue component then renders it using v-html, which interprets arbitrary HTML/JavaScript. The attack requires an authenticated backend user with product management permissions but affects any unauthenticated visitor viewing the compromised product page. No patch has been released; the project maintainers have not responded to the issue report.

Affected products

linlinjava litemall 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0 and current master

Timeline

2026-09-13: disclosed: CVE-2026-90570 published on NVD
2026-08-01: other: Security issue reported to Gitee (IK5SVR)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.