Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.9
CVE-2026-82654: SiYuan block names can run hidden scripts
CVE-2026-82654 · published 2 months ago
Summary
Versions of the SiYuan note‑taking app before 3.8.1 do not properly clean the text entered in block names, aliases or memos. An attacker could place HTML or JavaScript code in those fields, causing the code to run automatically when another user opens a document that shows the block. Upgrade to version 3.8.1 or later to fix the issue.
What to do
- Update siyuan-note siyuan to version 3.8.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| siyuan-note | siyuan | < 3.8.1 |
Original advisory text
SiYuan before v3.8.1 Stored XSS via block name
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hf87-qh3j-3p88 Vendor Advisory
- https://www.vulncheck.com/advisories/siyuan-before-3.8.1-stored-xss-via-block-na... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82654... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-82654 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published30 Aug 2026
Updated4 Nov 2026
First seen30 Aug 2026
Track software like this
Free during beta