Executive brief
litemall is an open-source e-commerce platform that allows administrators to create and edit product details. An unvalidated product detail field is rendered as raw HTML on the public product page, allowing an attacker with product editing permissions to inject malicious scripts that execute in the browsers of any customer viewing that product. This can lead to theft of customer session data, account compromise, or malware distribution.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in litemall versions 1.4.0 through 1.8.0 and current master. The vulnerability exists in the product detail flow: the AdminGoodsService.validate() method does not sanitize the goods.detail field when processing POST /admin/goods/create or /admin/goods/update requests (which require admin:goods:create or admin:goods:update permission). The unsanitized detail is persisted to the database and later served by GET /wx/goods/detail without escaping. The public-facing Vue component then renders it using v-html, which interprets arbitrary HTML/JavaScript. The attack requires an authenticated backend user with product management permissions but affects any unauthenticated visitor viewing the compromised product page. No patch has been released; the project maintainers have not responded to the issue report.
Affected products
- linlinjava litemall 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0 and current master
Timeline
- 2026-09-13: disclosed: CVE-2026-90570 published on NVD
- 2026-08-01: other: Security issue reported to Gitee (IK5SVR)