CVE-2026-82653

SiYuan before v3.8.1 contains a stored cross-site scripting flaw (CWE-79) in its confirmDialog() function, which interpolates bazaar package names and encrypted notebook names directly into innerHTML without escaping. An attacker who publishes a marketplace (bazaar) package with HTML or script content in its name field can have that payload execute in the browser of any user who triggers a confirmation dialog, such as when uninstalling the package or unlocking an encrypted notebook. Successful exploitation grants the attacker arbitrary script execution in the victim's authenticated SiYuan session, enabling actions on the victim's behalf such as data theft or account manipulation. Any SiYuan deployment running a version prior to 3.8.1 is affected, particularly instances whose users install packages from the community bazaar. Exploitation has not been observed: there is no known public proof of concept, EPSS is currently 0.2% (13th percentile), and the flaw is not in CISA KEV.

What to do: Upgrade SiYuan to v3.8.1 or later, which escapes package and notebook names before rendering in confirmation dialogs. Until upgraded, limit bazaar package installs to trusted publishers and avoid uninstalling newly installed community packages or unlocking notebooks of unknown origin in untrusted workspaces. Monitor the bazaar for packages with suspicious HTML/script content in display names, and re-check EPSS/KEV status for signs of emerging exploitation.