CVE-2021-38221: There are several stored XSS vulnerabilities · Issue #112 · mlogclub/bbs-go

Affected version: <= 3.3.0 (all versions yet)
Including Custom Edition I guess.

Usage of “v-html” tag should be really careful in vue. I found several unsafe usage in bbs-go webpage which data source might be from any user. It’s necessary to filter the rich text before it is posted to the client. Otherwise it will be dangerous.

Here is the XSS attack example screenshot (one of them) :

And the unsafe “v-html” tag for topic content (one of them) :

I will report the poc code after mlogclub team confirm and fix this defect.