CVE-2026-82654

SiYuan before version 3.8.1 does not properly escape a block's name, alias, and memo fields when rendering hint tooltips, backlinks, and breadcrumbs, allowing stored (persistent) cross-site scripting (CWE-79). An attacker with access to a shared or synced workspace sets these fields on a block to contain HTML or script tags, which execute in the browser of any other user who views a document that references or displays that block. Successful exploitation yields arbitrary JavaScript execution in the victim's session, with the CVSS 4.0 score (9.3, critical) reflecting high impact on confidentiality and integrity across the vulnerable and subsequent systems. All SiYuan deployments prior to 3.8.1 are affected, with multi-user or team-synced workspaces representing the realistic exposure since a second user must view the malicious block. No public proof-of-concept, in-the-wild exploitation, or KEV listing is currently known, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade SiYuan to version 3.8.1 or later. Until patched, restrict block creation and editing in shared or synced workspaces to trusted users, and treat block name, alias, and memo fields as untrusted input. Administrators of multi-user SiYuan deployments should prioritize patching since the flaw requires another user to view attacker-controlled content.