CVE-2026-116167: SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

Q: Who is exposed to this issue?

Users of SiYuan versions from 2.9.0 through versions before 3.8.7 are exposed if they can be persuaded to open a crafted link and then log in. No attacker authentication is required.

Q: What does an attacker need to exploit it?

The attacker needs to deliver a crafted link whose to parameter uses a javascript: URI and induce victim interaction. The script executes after the victim logs in, so the impact is in the context of that user's access.

Q: What could successful exploitation allow?

A successful attack can invoke kernel APIs to read or modify workspace content and settings available to the logged-in victim.

Q: How can I determine whether an instance is affected?

Check the deployed SiYuan version. Versions beginning at 2.9.0 and earlier than 3.8.7 are affected by the described unauthenticated /check-auth redirect handling.

Published Oct 25, 2026

Updated

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

Affected Software

1 affected component

SiYuan SiYuan>=2.9.0<3.8.7

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of SiYuan versions from 2.9.0 through versions before 3.8.7 are exposed if they can be persuaded to open a crafted link and then log in. No attacker authentication is required.

What does an attacker need to exploit it?

The attacker needs to deliver a crafted link whose to parameter uses a javascript: URI and induce victim interaction. The script executes after the victim logs in, so the impact is in the context of that user's access.

What could successful exploitation allow?

A successful attack can invoke kernel APIs to read or modify workspace content and settings available to the logged-in victim.

How can I determine whether an instance is affected?

Check the deployed SiYuan version. Versions beginning at 2.9.0 and earlier than 3.8.7 are affected by the described unauthenticated /check-auth redirect handling.

CVE-2026-116167: SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could successful exploitation allow?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could successful exploitation allow?

How can I determine whether an instance is affected?