This vulnerability affects quequnlong shiyi-blog up to version 1.2.1 in the highlightKeyword function of the Search component (blog-web/src/components/Search/index.vue). An attacker can manipulate the title or summary parameters to execute cross-site scripting attacks remotely. The CVSS 4.0 base score is 5.1, indicating a medium severity. The vulnerability was responsibly disclosed to the project. No known exploits in the wild have been reported, and no patch or fix details are currently available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires low attacker privileges and no user interaction but does not impact confidentiality, integrity, or availability directly according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding on the affected parameters (title/summary) to mitigate XSS risks.