Description

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The attack can be initiated remotely. The project was informed of the problem early through an issue report.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T16:16:52.827Z",
  "pubdate": "2026-09-13T16:16:52.827Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists in the quequnlong shiyi-blog component, affecting versions up to 1.2.1.\nThe vulnerability resides within the Search component's highlightKeyword function, which fails to properly sanitize user-supplied input contained in title or summary fields before rendering it in the Document Object Model (DOM).\nThis flaw allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript code within the context of a victim's browser session.\nSuccessful exploitation can result in unauthorized actions performed on behalf of the user, session hijacking via cookie theft, or the exfiltration of sensitive information displayed on the affected page.\nGiven that the vector is triggered via search manipulation, it presents a significant risk to the integrity and confidentiality of user interactions within the blogging platform.",
  "technicalDetails": "The vulnerability is located in the blog-web/src/components/Search/index.vue file, specifically within the highlightKeyword function of the Search component. The root cause is the improper handling of untrusted input provided via the title or summary arguments during the search result rendering process.\nIn the affected versions up to 1.2.1, the application performs a client-side search operation where keyword highlighting is applied dynamically to search results. The highlightKeyword function takes user-controlled data and injects it directly into the DOM without sufficient sanitization or the use of safe encoding mechanisms.\nWhen an attacker crafts a malicious request containing a crafted payload—such as an HTML tag with an 'onerror' attribute—the application reflects this input back to the user's browser as part of the search result interface. Because the browser interprets the injected content as active code rather than plain text, the JavaScript payload is executed within the security context of the origin domain.\nThe attack flow proceeds as follows: 1) The attacker constructs a URL or search query containing a malicious script payload (e.g., <img src=x onerror=alert(1)>); 2) The victim triggers a search using the malicious input or is tricked into clicking a link that performs the search; 3) The Search component processes the input within highlightKeyword; 4) The application renders the unsanitized input directly into the search results view; 5) The victim's browser executes the script, leading to unauthorized actions or credential theft.\nThis vulnerability is remotely exploitable without authentication, as the search functionality is typically accessible to any visitor. Because the code execution occurs on the client side, it bypasses server-side security controls and targets the victim's session directly. The impact is limited only by the privileges held by the victim and the permissions assigned to the browser's execution context at the time of the incident."
}