CVE-2026-90527

Name of the Vulnerable Software and Affected Versions quequnlong shiyi-blog versions prior to 1.2.2

Description A remote cross site scripting issue exists in the Add Message API component within the file blog-admin/src/views/message/message/index.vue. The flaw allows for the manipulation of the body.content argument, enabling an attacker to execute malicious scripts in the victim's browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the body.content parameter in the Add Message API until the issue is resolved.