A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. (CVE-2026-90564)
A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chat_msg leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.
AI Analysis
Technical Summary
CVE-2026-90564 identifies a cross-site scripting vulnerability in quequnlong shiyi-blog versions 1.0.0 to 1.2.1. The flaw is located in the SysChatMsgMapper.getChatMsgList function of the chat sendMsg endpoint, specifically in the handling of the chat_msg argument in the blog-web/src/views/chat/index.vue file. An attacker with network access and limited privileges can remotely manipulate this argument to execute XSS attacks. The project was notified early via an issue report but has not yet issued a fix or response.
Potential Impact
The vulnerability allows remote attackers with limited privileges to perform cross-site scripting attacks by manipulating the chat_msg argument. This can lead to injection of malicious scripts in the context of the affected application, potentially impacting users who interact with the chat feature. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.
Mitigation Recommendations
No official fix or patch is currently available as the project has not responded to the issue report. Users should monitor the project for updates or advisories. Until a patch is released, consider restricting access to the chat feature or applying web application firewall (WAF) rules to detect and block XSS payloads targeting the chat_msg parameter.
A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. (CVE-2026-90564)
Description
A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chat_msg leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v3.1
Score 3.5low
Affected software
pkg:github/quequnlong/shiyi-blogRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90564 identifies a cross-site scripting vulnerability in quequnlong shiyi-blog versions 1.0.0 to 1.2.1. The flaw is located in the SysChatMsgMapper.getChatMsgList function of the chat sendMsg endpoint, specifically in the handling of the chat_msg argument in the blog-web/src/views/chat/index.vue file. An attacker with network access and limited privileges can remotely manipulate this argument to execute XSS attacks. The project was notified early via an issue report but has not yet issued a fix or response.
Potential Impact
The vulnerability allows remote attackers with limited privileges to perform cross-site scripting attacks by manipulating the chat_msg argument. This can lead to injection of malicious scripts in the context of the affected application, potentially impacting users who interact with the chat feature. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.
Mitigation Recommendations
No official fix or patch is currently available as the project has not responded to the issue report. Users should monitor the project for updates or advisories. Until a patch is released, consider restricting access to the chat feature or applying web application firewall (WAF) rules to detect and block XSS payloads targeting the chat_msg parameter.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5332-wv38-3pxg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90564"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa7419d55bf5e2cf5489b9a
Added to database: 09/14/2026, 00:36:45 UTC
Last enriched: 09/14/2026, 00:39:55 UTC
Last updated: 09/14/2026, 03:01:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.