CVE-2026-90564: shiyi-blog Chat Message XSS Vulnerability

CVE-2026-90564 Overview

CVE-2026-90564 is a cross-site scripting (XSS) vulnerability affecting quequnlong shiyi-blog versions 1.0.0 through 1.2.1. The flaw resides in the SysChatMsgMapper.getChatMsgList function within blog-web/src/views/chat/index.vue, part of the chat sendMsg endpoint. Attackers can manipulate the chat_msg argument to inject arbitrary script content that executes in the browsers of other chat users. The attack is remotely exploitable and requires only low privileges combined with user interaction. According to the disclosure, the project maintainers were notified through an issue report but have not responded. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Remote attackers with a low-privileged account can inject JavaScript through the chat message endpoint, enabling session hijacking, credential theft, and unauthorized actions against other authenticated users of the blog platform.

Affected Products

quequnlong shiyi-blog 1.0.0
quequnlong shiyi-blog versions 1.1.x
quequnlong shiyi-blog 1.2.0 through 1.2.1

Discovery Timeline

2026-09-13 - CVE-2026-90564 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90564

Vulnerability Analysis

The vulnerability exists in the chat component of shiyi-blog, a self-hosted blogging platform. The sendMsg endpoint accepts a chat_msg parameter that is passed through to the SysChatMsgMapper.getChatMsgList mapper function without proper output encoding. When the chat message list is rendered in blog-web/src/views/chat/index.vue, attacker-supplied content is emitted directly into the DOM, allowing browser execution of injected script payloads.

Because chat messages are broadcast to other users of the chat feature, a single stored payload can affect every recipient who loads the affected view. The attack surface includes authenticated blog users interacting with the chat interface.

Root Cause

The root cause is missing neutralization of user-supplied input before it is stored and later rendered. The Vue component consumes chat message content returned from the backend mapper and injects it into the page without applying context-appropriate escaping or sanitization. This maps directly to [CWE-79], where untrusted input flows into an HTML output context unchanged.

Attack Vector

An authenticated attacker submits a crafted message through the chat sendMsg endpoint with a JavaScript payload embedded in the chat_msg field. The server persists the message and returns it through getChatMsgList when other users load the chat view. When a victim renders the chat panel, the injected script executes with the origin and privileges of the shiyi-blog application in the victim's browser session.

Exploitation requires low privileges (an authenticated chat account) and user interaction (viewing the chat). No verified public exploit code is available at the time of publication. Additional technical details are documented in the VulDB entry for CVE-2026-90564 and the upstream Gitee issue report.

Detection Methods for CVE-2026-90564

Indicators of Compromise

Chat messages containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URI schemes stored in the sys_chat_msg database table.
Outbound requests from user browsers to unfamiliar third-party domains immediately after loading the chat view.
Unexpected DOM modifications or new event handlers registered on the /chat route in browser telemetry.

Detection Strategies

Inspect HTTP POST bodies to the chat sendMsg endpoint for angle brackets, event handler attributes, and encoded script payloads.
Query stored chat records for values that contain executable HTML or JavaScript syntax rather than plain text.
Correlate authenticated session activity with anomalous outbound requests originating from the blog's frontend origin.

Monitoring Recommendations

Enable web application firewall (WAF) logging on all requests to the shiyi-blog chat API and alert on XSS signature matches.
Forward frontend Content Security Policy (CSP) violation reports to a centralized log store for review.
Monitor account creation and low-privileged user activity for message submission patterns consistent with payload testing.

How to Mitigate CVE-2026-90564

Immediate Actions Required

Restrict access to the chat feature or disable it entirely until a vendor patch is available, since the project has not yet responded to the disclosure.
Enforce a strict Content Security Policy that blocks inline scripts and untrusted script sources on all shiyi-blog pages.
Audit stored records in the chat message table and purge entries containing HTML or script content.
Rotate session tokens for users who interacted with the chat feature during the exposure window.

Patch Information

No official patch has been released. The maintainer of quequnlong/shiyi-blog was informed through an issue report but has not responded. Monitor the shiyi-blog Gitee repository and the tracking issue IK5RVL for updates. Until a fix ships, apply the mitigations below.

Workarounds

Place the shiyi-blog instance behind a WAF with rules that block angle brackets and JavaScript event handlers in chat request bodies.
Apply server-side HTML sanitization (for example, OWASP Java HTML Sanitizer or DOMPurify on the client) to chat content before rendering.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution.
Limit chat feature access to trusted user roles and remove anonymous or self-registration paths to the chat interface.

bash

# Example nginx configuration to enforce a strict Content Security Policy
# and block obvious XSS payloads targeting the chat endpoint
location /api/chat/sendMsg {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://shiyi_blog_backend;
}