CVE-2026-116167 in SiYuan
Summary
by MITRE • 10/25/2026
SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The SiYuan note-taking application, specifically versions ranging from 2.9.0 up to but not including the patched version 3.8.7, suffers from a critical cross-site scripting vulnerability located within its unauthenticated authentication check endpoint. This security flaw stems directly from improper input validation and output encoding practices when handling user-supplied data in the context of session management and redirection logic. The specific point of failure is found on the /check-auth page, which serves as an intermediary step during the application's login or token verification process. When a user interacts with this endpoint, particularly through links provided by external parties, the application processes a parameter named to without performing adequate scheme validation. This oversight allows malicious actors to inject JavaScript code into the redirection target, bypassing standard security controls that would typically restrict navigation to safe protocols such as HTTP or HTTPS.
From a technical perspective, the vulnerability exploits how the browser interprets URI schemes when assigning values to window.location.href. In modern web applications, it is a common and necessary practice to validate that any redirect destination begins with http:// or https:// to prevent script injection via javascript: URIs. However, in this instance, the application accepts the value of the to parameter and directly assigns it to the browser's location object without verifying the protocol scheme. This means that if an attacker crafts a URL where the to parameter is set to javascript:<malicious_code>, the browser will execute the script immediately upon redirection rather than navigating to a web page. Because this endpoint is unauthenticated, attackers do not need valid credentials to trigger the initial part of the attack chain; they only need to lure a victim with a legitimate SiYuan link that contains the malicious payload in its redirect parameter.
The operational impact of this vulnerability is severe due to the context in which it executes. The cross-site scripting occurs after or during the login process, meaning the script runs within the security context of an authenticated user session. Once the JavaScript code executes, it gains access to sensitive application data and functionality that would otherwise be restricted by same-origin policies. Specifically, attackers can invoke kernel APIs exposed by the SiYuan desktop environment or web interface to read workspace content, which may include personal notes, documents, and other private information stored within the user's account. Furthermore, the script has the capability to modify workspace settings and data, allowing for potential defacement of user records, insertion of malicious links into future notes, or even complete exfiltration of sensitive intellectual property. This transforms a simple input validation error into a full compromise of user confidentiality and integrity.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as cross-site scripting. More specifically, it falls under the subcategory of DOM-based XSS where the vulnerability is triggered by client-side scripts rather than server-rendered content. In terms of offensive security frameworks, this attack vector maps to MITRE ATT&CK technique T1059.007, which covers JavaScript execution on web browsers. The exploitation path also reflects aspects of T1189, Drive-by Client Hijacking, as the attacker relies on social engineering or compromised sites to deliver a crafted link that triggers the vulnerability upon interaction. The lack of scheme validation is a classic example of CWE-601, URL Redirection to Untrusted Site, which often leads to further exploitation if the redirected context allows for script execution.
To mitigate this risk, immediate action must be taken by upgrading SiYuan to version 3.8.7 or later, where the developers have presumably implemented proper input validation and output encoding mechanisms. For organizations still running affected versions, it is crucial to implement strict Content Security Policy headers that restrict the sources from which scripts can be executed, although this may not fully prevent exploitation if the application itself injects malicious code into its own DOM structure via window.location.href. Additionally, developers should enforce allowlists for URL schemes during redirection logic, ensuring that only http and https protocols are permitted in redirect parameters. Input sanitization routines must strip or encode special characters such as colons and slashes when they appear in positions where a scheme is expected. Regular security audits focusing on URI handling and authentication flows can help identify similar flaws before they are exploited by malicious actors seeking to compromise user data within the SiYuan ecosystem.