Description

A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-10-12T06:16:58.937Z",
  "pubdate": "2026-10-12T06:16:58.937Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists in the Dictionary Data Drawer Preview component of RuoYi versions up to 4.8.3.\nThe vulnerability resides within the 'renderDrawer' function, triggered by improper sanitization of the 'cssClass' argument.\nAn unauthenticated or remote attacker can inject arbitrary malicious JavaScript into the web application, which is then executed within the context of the victim's browser session.\nSuccessful exploitation allows for session hijacking, credential theft, unauthorized actions on behalf of the user, and the manipulation of the rendered document object model (DOM).\nBecause the exploit is publicly available and the vendor has remained unresponsive, the risk to organizations utilizing affected versions of RuoYi is considered significant.\nExploitation requires no complex interaction other than a user following a crafted link or navigating to a manipulated endpoint, making it a viable vector for phishing or social engineering campaigns.",
  "technicalDetails": "The vulnerability originates from the 'renderDrawer' function located in the '/system/dict/data/add' file path, specifically within the Dictionary Data Drawer Preview component.\nThe root cause is a failure to implement robust input validation or output encoding on the 'cssClass' parameter before it is reflected in the application's response to the client.\nWhen a request is submitted to the vulnerable endpoint with a crafted 'cssClass' parameter, the application embeds the user-supplied string directly into the HTML structure of the response without sufficient sanitization of sensitive characters, such as angle brackets, quotes, or script tags.\nThe attack flow begins with the attacker crafting a malicious payload, typically consisting of JavaScript encapsulated in HTML tags (e.g., <script>alert(1)</script> or <img src=x onerror=alert(1)>), and injecting it into the 'cssClass' argument of a request directed at the '/system/dict/data/add' endpoint.\nUpon receiving the request, the server-side component processes the input and includes the unvalidated payload in the rendered HTML source code returned to the browser.\nWhen the victim's browser processes the response, the injected script is parsed as legitimate code rather than data, triggering execution within the victim's security context (Origin).\nThis execution allows the attacker to access sensitive information including session cookies, local storage, and CSRF tokens associated with the RuoYi application.\nFurthermore, the attacker can leverage this execution to manipulate the DOM, perform unauthorized state-changing operations via asynchronous requests, or redirect the user to a malicious external domain.\nBecause the payload is reflected in the HTTP response, the vulnerability is classified as reflected XSS, which is highly effective when combined with social engineering techniques that entice authenticated users to visit the crafted URL.\nThe vulnerability affects all RuoYi versions up to 4.8.3. The lack of context-aware output encoding throughout this specific module suggests a wider design oversight in how UI components handle dynamic styling attributes."
}