CVE-2026-90567: quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-13 · updated 2026-09-15
Weakness: CWE-79

Description

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The attack can be initiated remotely. The project was informed of the problem early through an issue report.

Affected products

quequnlong shiyi-blog: 1.2.0, 1.2.1

References

https://gitee.com/quequnlong/shiyi-blog/
https://gitee.com/quequnlong/shiyi-blog/issues/IK5SPD
https://vuldb.com/cve/CVE-2026-90567
https://vuldb.com/submit/912671
https://vuldb.com/vuln/403152
https://vuldb.com/vuln/403152/cti

Get alerted when CVE-2026-90567 or the next vulnerability affects your stack