This vulnerability affects quequnlong shiyi-blog up to versions 1.2.0 and 1.2.1. It arises from improper handling of the body.content argument in the Add Message API component, leading to cross-site scripting (XSS). The vulnerability can be exploited remotely without authentication. No patch or official fix has been released as the project has not responded to the issue report.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should consider applying input validation or sanitization workarounds on the body.content parameter to mitigate XSS risks until an official patch is available.