CVE-2026-90527 describes a cross-site scripting vulnerability in quequnlong shiyi-blog versions up to 1.2.1. The flaw is located in an unknown function within the Add Message API component, specifically in the file blog-admin/src/views/message/message/index.vue. Manipulating the body.content argument allows injection of malicious scripts. The vulnerability is remotely exploitable and requires user interaction to trigger. No patch or remediation has been provided by the vendor as of the publication date.

The vulnerability allows an attacker to perform cross-site scripting attacks by injecting malicious scripts via the body.content argument. This can lead to limited impact such as user interface manipulation or phishing attacks within the affected application context. There is no indication of confidentiality or availability impact. The CVSS score of 4.3 reflects a medium severity with no confidentiality or availability impact, requiring user interaction for exploitation.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should exercise caution when handling untrusted input in the affected component. Monitor the vendor's channels for updates and apply any future patches promptly. Until a fix is released, consider implementing input validation or sanitization as a temporary mitigation if feasible.