CVE-2026-90527: shiyi-blog XSS Vulnerability

CVE-2026-90527 Overview

CVE-2026-90527 is a stored cross-site scripting (XSS) vulnerability in the quequnlong shiyi-blog project through version 1.2.1. The flaw resides in the Add Message API component, specifically within blog-admin/src/views/message/message/index.vue. Attackers can manipulate the body.content argument to inject arbitrary script payloads that execute in the browsers of users who view the affected message content.

The issue is exploitable remotely and requires user interaction to trigger the payload. According to the disclosure, the project maintainer was notified through a public issue report but has not responded. No official patch is available at the time of publication.

Critical Impact
Remote attackers can inject persistent JavaScript into the blog messaging component, enabling session hijacking, credential theft, and administrative account compromise when victims render the tainted content.

Affected Products

quequnlong shiyi-blog versions up to and including 1.2.1
Component: Add Message API
File: blog-admin/src/views/message/message/index.vue

Discovery Timeline

2026-09-13 - CVE-2026-90527 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90527

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under CWE-79. The Add Message API in shiyi-blog accepts a body.content field from remote clients and persists it without adequate sanitization or output encoding. When the stored content is later rendered in the administrative Vue.js interface at blog-admin/src/views/message/message/index.vue, injected markup executes in the context of the viewing user's session.

Because the payload lands in an administrative view, an unauthenticated attacker who submits a crafted message can target privileged users who later open the messages panel. Successful execution grants the attacker the same origin privileges as the administrator, including access to session cookies, CSRF tokens, and any authenticated API surface.

Root Cause

The root cause is missing input validation and output encoding on the body.content parameter accepted by the Add Message API. User-supplied HTML and script content is stored verbatim and rendered without contextual escaping in the Vue template.

Attack Vector

Exploitation proceeds over the network without authentication. An attacker submits a POST request to the Add Message endpoint containing a JavaScript payload in the body.content field. The payload is stored server-side and executed each time an administrator or moderator loads the message management view. Public reporting confirms the project has not acknowledged the issue, so exposed instances remain vulnerable.

No verified proof-of-concept code has been published. Refer to the Gitee Issue Tracker Entry and VulDB CVE-2026-90527 for additional technical context.

Detection Methods for CVE-2026-90527

Indicators of Compromise

HTTP POST requests to the message submission endpoint containing <script>, onerror=, onload=, or javascript: substrings in the content field.
Stored records in the messages table containing HTML tags, event handlers, or encoded script fragments.
Outbound requests from administrator browsers to unfamiliar domains shortly after viewing the messages panel.

Detection Strategies

Inspect application and reverse-proxy logs for anomalous payloads submitted to the Add Message API, especially oversized or HTML-bearing body.content values.
Deploy a web application firewall (WAF) rule that flags script tags, event-handler attributes, and encoded XSS vectors in message submission requests.
Perform periodic database queries against the messages table to identify entries containing markup that should not appear in plain text comments.

Monitoring Recommendations

Monitor administrator sessions for unexpected API calls, token exports, or user-management operations initiated from the messages view.
Alert on new outbound network connections from browsers used to access blog-admin routes.
Enable Content Security Policy (CSP) violation reporting to capture inline script execution attempts in the admin interface.

How to Mitigate CVE-2026-90527

Immediate Actions Required

Restrict public access to the shiyi-blog message submission endpoint until sanitization is in place, for example via IP allowlisting or authentication.
Review existing message records and purge any entries containing HTML, script tags, or suspicious event handlers.
Rotate administrator credentials and invalidate active admin sessions if evidence of exploitation is found.

Patch Information

No official patch is available. The maintainer has not responded to the disclosure per the Gitee Issue Tracker Entry. Track the Gitee Blog Repository for future updates and apply any vendor-supplied fixes as soon as they are released.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources across the blog-admin interface.
Add server-side sanitization on the Add Message API using a vetted HTML sanitizer to strip tags and event handlers from body.content before storage.
Apply contextual output encoding in the Vue template rendering the messages view so stored content is treated as text rather than markup.
Deploy a WAF signature that blocks common XSS payload patterns in requests targeting the message API path.

bash

# Configuration example
# Example nginx directive to enforce a restrictive CSP on the admin interface
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;