high8.9
CVE-2026-82653
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated …
Impact
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
Affected products
| Product | Affected versions |
|---|---|
| SiYuan | before 3.8.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.