CVE-2026-82654 in SiYuan
Summary
by MITRE • 08/30/2026
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified in SiYuan versions prior to 3.8.1 represents a classic Cross-Site Scripting (XSS) flaw rooted in insufficient input validation and output encoding within the application's rendering engine. Specifically, the defect lies in how the software processes block metadata fields such as names, aliases, and memos when generating hint tooltips, backlink lists, and breadcrumb navigation elements. These components are designed to provide contextual information about specific content blocks to users viewing a document. However, because these fields were not properly sanitized or encoded before being injected into the HTML structure of the user interface, they serve as vectors for malicious script injection. This architectural oversight allows an attacker who has write access to create or modify a block with specially crafted metadata containing executable JavaScript code rather than plain text.
From a technical perspective, this vulnerability is categorized under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector relies on the victim user viewing content that references or displays the compromised block. When the SiYuan client renders these specific UI elements—such as hovering over a link to see a hint or navigating through breadcrumbs—the browser interprets the unescaped script tags embedded in the metadata as executable code rather than data. This execution occurs within the context of the application's domain, granting the injected scripts full access to the session cookies, local storage tokens, and other sensitive client-side state managed by SiYuan. The flaw is particularly insidious because it does not require direct interaction with a form submission or file upload; merely viewing content containing the malicious block triggers the exploit, making it an automated attack surface for any user interacting with documents authored by a compromised account.
The operational impact of this vulnerability extends beyond simple defacement or alert boxes. Since SiYuan is often used as a knowledge base and note-taking application where users store sensitive personal or professional information, successful exploitation can lead to session hijacking. An attacker could steal authentication tokens stored in local storage or cookies, allowing them to impersonate the victim user within the application. Furthermore, if the application integrates with external services or APIs that rely on client-side credentials, those integrations could be abused to exfiltrate data from connected platforms. In collaborative environments where multiple users view shared documents, a single malicious block can compromise every viewer who interacts with the affected content, facilitating widespread credential theft and unauthorized access to private notes without raising immediate suspicion among other collaborators.
Mitigation strategies for this vulnerability primarily involve upgrading to SiYuan version 3.8.1 or later, which addresses these rendering flaws by implementing strict output encoding and input validation mechanisms. For organizations unable to immediately patch their instances, administrative controls should be enforced to restrict the creation of blocks with complex metadata until updates are applied. Additionally, developers must ensure that all dynamic content injected into HTML structures is passed through a robust sanitization library that adheres to OWASP guidelines for preventing XSS attacks. This includes encoding special characters such as less-than and greater-than signs in block names and aliases before they are rendered by the browser. Security teams should also monitor user activity logs for unusual patterns of document editing or metadata modification, which may indicate attempts to exploit this flaw prior to patching. Regular security audits focusing on input handling in rich text editors and rendering engines are essential to prevent similar vulnerabilities from persisting in future releases.