CVE-2026-90564

Name of the Vulnerable Software and Affected Versions quequnlong shiyi-blog versions 1.0.0 through 1.2.1

Description A remote cross site scripting issue exists in the chat sendMsg endpoint. The flaw is located within the SysChatMsgMapper.getChatMsgList() function in the file blog-web/src/views/chat/index.vue. An attacker can exploit this by manipulating the chat msg argument.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the chat sendMsg endpoint or avoid using the chat msg argument until a patch is available.