| Title | y_project RuoYi 4.8.3 Cross Site Scripting |
|---|
| Description | RuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by stored cross-site scripting in the dictionary-data drawer preview.
A user with system:dict:add can persist cssClass through POST /system/dict/data/add. The field has a length check only. The default XSS filter (xss.enabled=true) strips tags but keeps double quotes. The v4.8.3 renderDrawer() function concatenates cssClass into <span class="..."> and parses it with jQuery .html(). A quote can close the class attribute and add an event handler.
A local Docker test stored cssClass=x" onmouseover="document.body.dataset.cveProbe=1 with a non-admin ry account. After an administrator opened /system/dict and the sys_normal_disable drawer, the DOM contained <span class="x" onmouseover="document.body.dataset.cveProbe=1">E2E_XSS_PROBE</span>. Dispatching mouseover set document.body.dataset.cveProbe to 1.
This is distinct from RuoYi issues 212, 308, 320, and 329, which use other fields and sinks. v4.8.2 does not contain this drawer path.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xssRuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by stored cross-site scripting in the dictionary-data drawer preview.
A user with system:dict:add can persist cssClass through POST /system/dict/data/add. The field has a length check only. The default XSS filter (xss.enabled=true) strips tags but keeps double quotes. The v4.8.3 renderDrawer() function concatenates cssClass into <span class="..."> and parses it with jQuery .html(). A quote can close the class attribute and add an event handler.
A local Docker test stored cssClass=x" onmouseover="document.body.dataset.cveProbe=1 with a non-admin ry account. After an administrator opened /system/dict and the sys_normal_disable drawer, the DOM contained <span class="x" onmouseover="document.body.dataset.cveProbe=1">E2E_XSS_PROBE</span>. Dispatching mouseover set document.body.dataset.cveProbe to 1.
This is distinct from RuoYi issues 212, 308, 320, and 329, which use other fields and sinks. v4.8.2 does not contain this drawer path.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss |
|---|
| Source | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss |
|---|
| User | bobtao666 (UID 100998) |
|---|
| Submission | 09/06/2026 17:59 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:36 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416579 [y_project RuoYi up to 4.8.3 Dictionary Data Drawer Preview /system/dict/data/add renderDrawer cssClass cross site scripting] |
|---|
| Points | 20 |
|---|