Description

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-13T15:16:28.487Z",
  "pubdate": "2026-09-13T15:16:28.487Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the shiyi-blog project up to version 1.2.1, specifically within the Add Message API component.\nThe vulnerability is located in the blog-admin/src/views/message/message/index.vue file, where the body.content parameter is insufficiently sanitized.\nThis flaw allows remote attackers to inject malicious scripts into the application, which are then executed within the context of a victim's browser session.\nSuccessful exploitation can result in unauthorized actions, session hijacking, credential theft, or defacement of the affected administrative interface.\nThe vulnerability is accessible remotely and requires no specific local access, posing a significant risk to the integrity and confidentiality of the administrative panel.\nAs of the current reporting, the vendor has not released a patch to address this security flaw.",
  "technicalDetails": "The vulnerability is a classic stored or reflected Cross-Site Scripting (XSS) flaw localized to the Add Message API implementation within the administrative module of shiyi-blog.\nThe root cause of the vulnerability lies in the improper handling of user-supplied input via the 'body.content' argument within the file 'blog-admin/src/views/message/message/index.vue'.\nWhen a user submits content through the affected API, the application fails to perform adequate input validation or context-aware output encoding. Consequently, the input is rendered directly into the Document Object Model (DOM) without escaping special characters that hold semantic meaning in HTML, such as '<', '>', '\"', and \"'\".\nAn attacker can exploit this by crafting a malicious payload containing JavaScript, such as '<script>alert(document.cookie)</script>' or other event-handler-based injections like '<img src=x onerror=alert(1)>'.\nThe attack flow begins with the adversary sending a crafted HTTP request to the Add Message API, embedding the malicious payload within the 'body.content' parameter. Once the server accepts the input and subsequently renders this message in the administration dashboard for a victim user, the browser interprets the payload as legitimate code rather than data.\nBecause the execution occurs within the victim's session, the injected script gains access to the victim's current document, including cookies, session tokens, and local storage. This grants the attacker the ability to perform actions on behalf of the victim, potentially leading to privilege escalation if an administrator views the malicious message.\nThe vulnerability is remotely exploitable and does not explicitly require specific client-side interaction other than the viewing of the message by a privileged user within the affected 'blog-admin' context. The lack of Content Security Policy (CSP) headers exacerbates the impact by allowing the execution of inline scripts, further lowering the barrier for successful exploitation.\nThe affected versions include all shiyi-blog releases up to and including 1.2.1. The administrative nature of the component makes this an high-severity issue, as it compromises the administrative oversight and security management of the blog instance."
}