CVE-2026-90564
Received Received - Intake

Stored XSS in Shiyi-Blog Chat Functionality

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chat_msg leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90564
EUVD
EUVD-2026-77038

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
quequnlong shiyi-blog 1.0.0
quequnlong shiyi-blog 1.2
quequnlong shiyi-blog 1.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the shiyi-blog system versions 1.0.0 to 1.2.1. An attacker with normal user privileges can send a malicious script via the POST /chat/sendMsg endpoint by controlling the content parameter. The backend saves this message to the chat_msg table and broadcasts it to all WebSocket sessions. When other logged-in users view the chat history or receive messages in real time, the content is rendered using Vue's v-html directive, executing the malicious script in their browsers.

Detection Guidance

Check if your shiyi-blog instance is running versions 1.0.0, 1.2, 1.2.1, or master. Inspect POST requests to /chat/sendMsg for unsanitized user input in the content parameter. Monitor WebSocket traffic for broadcasted messages containing script tags. Review frontend rendering logic for v-html usage in chat message display.

Impact Analysis

The impact includes arbitrary script execution in victims' browsers, potentially leading to data theft, session hijacking, or account takeover. Attackers can steal sensitive information like cookies or session tokens, perform actions on behalf of victims, or redirect users to malicious sites. The severity depends on the deployment environment's Content Security Policy (CSP) and cookie settings.

Compliance Impact

This vulnerability may violate compliance requirements such as GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized access to sensitive user data. It could lead to data breaches, unauthorized disclosure of personal information, or compromised user accounts, resulting in legal penalties and reputational damage.

Mitigation Strategies

Disable v-html rendering for chat messages and switch to plain text. Implement HTML sanitization using a whitelist approach before storing messages. Update to a patched version if available. Add session filtering for historical message retrieval. Review CSP and Cookie policies to limit script execution impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90564. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart