CVE-2026-90567: shiyi-blog XSS Vulnerability

CVE-2026-90567 Overview

CVE-2026-90567 is a cross-site scripting (XSS) vulnerability affecting quequnlong shiyi-blog versions up to 1.2.1. The flaw resides in the highlightKeyword function of blog-web/src/components/Search/index.vue within the Search component. Attackers can manipulate the title and summary arguments to inject arbitrary script content that executes in the browser of any user viewing crafted search results. The attack is remotely exploitable and requires low privileges combined with user interaction. The project maintainers were notified through an issue report before public disclosure. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Remote attackers can execute arbitrary JavaScript in victim browsers, enabling session token theft, phishing overlays, and unauthorized actions performed on behalf of authenticated blog users.

Affected Products

• quequnlong shiyi-blog versions up to and including 1.2.1
• Component: Search (blog-web/src/components/Search/index.vue)
• Function: highlightKeyword

Discovery Timeline

• 2026-09-13 - CVE-2026-90567 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90567

Vulnerability Analysis

The vulnerability originates in the highlightKeyword client-side helper used by the shiyi-blog Search component. The function receives title and summary fields returned by search queries and injects them into the rendered DOM to visually highlight matched keywords. Because the routine performs string manipulation and inserts the result as raw HTML rather than as text, attacker-controlled markup contained within either argument is parsed by the browser.

An adversary who can influence a stored post title or summary, or who can craft a search query that reflects unsanitized content back into the page, can inject script payloads. When another user renders the affected search view, the injected script executes with the origin and privileges of the shiyi-blog application.

Exploitation supports theft of session cookies, forced state-changing requests against the blog backend, and delivery of secondary payloads to authenticated administrators. Because the payload lives inside a highlight helper, the malicious content blends into legitimate search results and is unlikely to raise suspicion.

Root Cause

The root cause is missing output encoding inside the highlightKeyword function. The Vue single-file component treats the highlighted string as trusted HTML rather than escaping angle brackets, quotes, and event-handler attributes. This maps directly to [CWE-79].

Attack Vector

The attack vector is network-based. An attacker submits a payload through any input path that ultimately populates the title or summary field consumed by the Search component. When a victim performs a search that returns the crafted record, the browser renders the payload and executes attacker-controlled JavaScript. User interaction is required in the form of viewing or querying the affected search interface.

No verified proof-of-concept code is published in the referenced advisories. Technical details are tracked in the Gitee Issue Tracker and the VulDB CVE-2026-90567 entry.

Detection Methods for CVE-2026-90567

Indicators of Compromise

• Blog posts or search records whose title or summary fields contain HTML tags such as <script>, <img onerror=...>, or <svg onload=...>.
• Outbound browser requests from authenticated sessions to unfamiliar domains shortly after visiting the search page.
• Unexpected administrative actions performed from accounts that recently viewed search results.

Detection Strategies

• Inspect database records backing the search index for stored HTML or JavaScript within title and summary columns.
• Add web application firewall (WAF) rules that flag search-related POST/GET traffic containing script tags, event handlers, or JavaScript URI schemes.
• Enable Content Security Policy (CSP) violation reporting to surface inline script executions rendered inside the Search view.

Monitoring Recommendations

• Monitor HTTP access logs for search queries containing encoded XSS payloads (%3Cscript%3E, onerror=, javascript:).
• Correlate browser CSP reports with authenticated user sessions to identify affected viewers.
• Alert on newly created or edited blog posts whose fields fail HTML validation checks.

How to Mitigate CVE-2026-90567

Immediate Actions Required

• Restrict content submission to trusted authors until the highlightKeyword function is patched.
• Sanitize existing title and summary records to remove HTML markup and JavaScript payloads.
• Deploy a strict Content Security Policy that disallows inline scripts on pages rendering search results.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track fixes and commits through the Gitee Blog Repository and the linked Gitee Issue Tracker. Upgrade to a release later than 1.2.1 once the maintainer publishes a fixed version.

Workarounds

• Modify highlightKeyword in blog-web/src/components/Search/index.vue to escape HTML entities before wrapping matched keywords, or render the result using Vue text bindings ({{ }}) rather than v-html.
• Apply server-side input validation that rejects or encodes HTML characters in post titles and summaries before storage.
• Implement a WAF rule set that blocks common XSS payload patterns targeting the search endpoint.

# Example CSP header to reduce XSS impact on the shiyi-blog frontend
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";