EUVD-2026-36750
GHSA-qmg6-vw55-xp4c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PR:L applied because /system/notice/add is a system management endpoint typically requiring authentication, making the submitted PR:N inconsistent with the endpoint's function.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
AnalysisAI
Cross-site scripting in RuoYi 4.8.2 enables script injection via the /system/notice/add endpoint, executing malicious payloads in the browsers of users who subsequently view the injected notice content. The CVSS Scope:Changed designation confirms the impact escapes the originating component's trust boundary, affecting victim sessions across the application. A proof-of-concept is available per SSVC data; however, no CISA KEV listing exists and the EPSS score of 0.15% (4th percentile) reflects negligible observed exploitation probability at time of analysis.
Technical ContextAI
RuoYi is a Java/Spring Boot-based open-source rapid application development framework widely used for enterprise back-office systems in Chinese development communities. The vulnerable endpoint /system/notice/add is the notice and announcement creation interface within RuoYi's system management module. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as a failure to sanitize or encode user-supplied input before it is rendered in the browser - allowing injected script content to persist in stored notices and execute when viewed. The CVSS S:C metric confirms the payload executes in a security context outside the originating component, meaning scripts run in victim users' browser sessions. No formal NVD CPE string is registered (the submitted CPE is cpe:2.3:a:n/a:n/a), indicating the vulnerability was filed through MITRE without a completed CPE mapping at time of analysis, which limits automated scanning detection.
RemediationAI
No vendor-released patch or official security advisory has been identified at time of analysis - the disclosure originated as a GitHub issue report without a corresponding fix commit or tagged release. Operators should monitor the upstream repository at https://github.com/yangzongzhuan/RuoYi/issues/320 for remediation activity. As compensating controls: restrict access to the /system/notice/add endpoint exclusively to trusted administrator roles through application-layer access controls, reducing exposure in the absence of a PR:N-level attack path. Implement a Content Security Policy (CSP) response header with a restrictive script-src directive to limit script execution to approved origins - this does not eliminate the injection flaw but substantially reduces its impact by preventing payload execution; note CSP may break legitimate inline scripts if not tuned carefully. Apply output encoding on all notice-body fields at the rendering layer as an immediate developer-side mitigation. If the notice creation feature is not actively used, disable the route in the application's routing configuration to remove the attack surface entirely.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today