CVE-2026-84803

SiYuan before v3.8.2 contains a stored cross-site scripting flaw (CWE-79) in how it serves uploaded assets: its file-extension blocklist omits script-capable types such as .xht, .ehtml, .xsl, .xbl, and .rdf, so these uploads are delivered as executable media instead of inert files. An authenticated user with upload privileges (CVSS PR:L) can plant such a file in a workspace, and when another user opens or views the served asset, attacker-controlled JavaScript executes in their browser (user interaction required). The injected script can steal API tokens, giving the attacker access to the victim's account and the ability to compromise workspaces. Anyone running a SiYuan instance prior to v3.8.2 is affected. Exploitation is not currently observed: there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Upgrade SiYuan to v3.8.2 or later. As an interim mitigation, block or rename uploads with script-capable extensions (.xht, .ehtml, .xsl, .xbl, .rdf) or serve assets with attachment-style headers/safe Content-Types so they cannot execute in the browser. Administrators of shared or multi-user workspaces should review previously uploaded assets for these file types and rotate API tokens if suspicious activity is found.