CVE-2026-116167

SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

Published Oct 25, 2026 CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Description

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

Analysis

Technical impact

The vulnerability is a cross‑site scripting flaw in SiYuan's unauthenticated /check‑auth endpoint that assigns the to parameter to window.location.href without validating its scheme. Attackers can craft a link containing a javascript: URI that runs after a user logs in, enabling the attacker to invoke kernel APIs to read or alter workspace content and settings. The flaw therefore permits client‑side script execution with the privileges of the logged‑in user.

Affected Systems

The vulnerability affects all SiYuan releases from version 2.9.0 through 3.8.6 inclusive. The fix is available in version 3.8.7, which removes the unchecked assignment and introduces proper scheme validation. The affected vendor is siyuan‑note, product siyuan.

Risk and Exploitability

With a CVSS score of 7.6, this issue is considered moderate‑to‑high severity. No EPSS score is provided and it is not listed in CISA KEV. The vulnerability is accessed via an unauthenticated web request, and requires a user to click the crafted link, which after authentication grants script execution. Attackers could use this to steal data or modify settings, so the risk remains significant until patched.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

siyuan-note

siyuan

unaffected

Version	Status	Constraints
`2.9.0`	affected	< 3.8.7
`3.8.7`	unaffected	—

No data.

Vendor Product Versions

B3log

Siyuan

Version	Status	Scheme	Platform
`—`	affected	—	—

Siyuan

Version	Status	Scheme	Platform
`[2.9.0,3.8.7)`	affected	semver	—
`3.8.7`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade SiYuan to v3.8.7 or later.
Ensure the /check‑auth endpoint is not exposed to unauthenticated users, or replace it with a protected version that validates the to parameter’s scheme.
Apply a strict Content‑Security‑Policy or similar browser‑side controls to block inline script execution and disallow javascript: URLs.

Generated by OpenCVE AI on October 25, 2026 at 16:42 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.656% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4w
https://www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameter

History

Oct 26, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Siyuan Siyuan siyuan
Vendors & Products		Siyuan Siyuan siyuan

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.
Title		SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter
First Time appeared		B3log B3log siyuan
Weaknesses		CWE-79
CPEs		cpe:2.3:a:b3log:siyuan::::::::
Vendors & Products		B3log B3log siyuan
References		https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4w https://www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameter
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`