CVE-2026-82653 in SiYuan
Summary
by MITRE • 08/30/2026
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.