CVE-2026-108802
Deferred Deferred - Pending Action

Cross-Site Scripting in RuoYi up to 4.8.3

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108802
EUVD
EUVD-2026-97234

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
y_project RuoYi 4.8.0
y_project RuoYi 4.8.1
y_project RuoYi 4.8.2
y_project RuoYi 4.8.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in RuoYi version 4.8.3. It allows an attacker with low privileges to inject malicious JavaScript code via the dictionary preview feature by manipulating the cssClass parameter. When an administrator views the dictionary list and hovers over the affected entry, the injected script executes.

Detection Guidance

Check RuoYi admin interfaces for dictionary entries with suspicious cssClass values containing event handlers like onmouseover. Inspect POST requests to /system/dict/data/add for payloads such as cssClass=test" onmouseover="alert(1). Review HTML templates in ruoyi-admin/src/main/resources/templates/system/dict/type/type.html for unsanitized cssClass usage.

Impact Analysis

An attacker could execute arbitrary JavaScript in the context of a victim's RuoYi admin session. This may lead to session hijacking, unauthorized actions, or theft of sensitive data. The exploit requires minimal user interaction and can bypass default protections.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. It may result in data breaches, non-compliance penalties, and loss of trust.

Mitigation Strategies

Upgrade RuoYi to a patched version if available. Implement strict input validation for cssClass parameters in dictionary data handlers. Apply output encoding when rendering user-controlled data in HTML attributes. Disable the dictionary preview feature if unused. Monitor admin sessions for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart