CVE-2026-90567
Received Received - Intake

Cross-Site Scripting in shiyi-blog Search Component

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The attack can be initiated remotely. The project was informed of the problem early through an issue report.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90567
EUVD
EUVD-2026-77044

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quequnlong shiyi-blog to 1.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the shiyi-blog system up to version 1.2.1. It occurs in the Search component where the highlightKeyword function processes user-controlled input (title/summary) without proper sanitization. Malicious scripts injected via article titles or summaries are later rendered in the frontend search results, triggering the XSS attack when displayed.

Detection Guidance

To detect this vulnerability, inspect the shiyi-blog application for versions up to 1.2.1. Check if the Search component's highlightKeyword function processes user-controlled input without HTML filtering. Look for GET /api/article/list responses containing unfiltered article titles or summaries with malicious scripts. Test by injecting basic XSS payloads like <script>alert(1)</script> in article fields and observe if they execute when rendered via v-html.

Impact Analysis

An attacker with article editing privileges could inject malicious scripts into blog titles or summaries. When other users search for articles, the injected scripts execute in their browsers, potentially stealing cookies, session tokens, or sensitive data. Even anonymous users visiting affected pages could be compromised.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if healthcare-related content is targeted. Both regulations require protecting user data from such attacks.

Mitigation Strategies
  • Apply HTML entity encoding to article titles and summaries before storage and display.
  • Replace Vue's v-html with safe text rendering methods for search highlights.
  • Restrict article fields to plain text on the server side and encode historical data.
  • Implement cross-account security testing to prevent privilege escalation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart