CVE-2026-116169: SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

Q: Who can exploit this issue?

An attacker needs edit permission in SiYuan to save a malicious math block. Exploitation also requires a reader to click the rendered link or resource containing the javascript: URL.

Q: Which deployments are affected?

The issue affects SiYuan versions from 2.10.0 before 3.8.7 where math content is rendered with KaTeX trust enabled. The provided data does not establish whether KaTeX trust is enabled by default.

Q: What payload locations should be reviewed when investigating possible exploitation?

Review editable math blocks for KaTeX \href, \url, or \includegraphics constructs containing javascript: URLs. These payloads may be stored and later execute in the application origin when a reader clicks the rendered content.

Published Oct 25, 2026

Updated

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that mathRender assigns via innerHTML, executing script in the application origin when a reader clicks the rendered link.

Affected Software

1 affected component

SiYuan SiYuan>=2.10.0<3.8.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SiYuan to a version that resolves this vulnerability.
Fixed in 3.8.7

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs edit permission in SiYuan to save a malicious math block. Exploitation also requires a reader to click the rendered link or resource containing the javascript: URL.

Which deployments are affected?

The issue affects SiYuan versions from 2.10.0 before 3.8.7 where math content is rendered with KaTeX trust enabled. The provided data does not establish whether KaTeX trust is enabled by default.

What payload locations should be reviewed when investigating possible exploitation?

Review editable math blocks for KaTeX \href, \url, or \includegraphics constructs containing javascript: URLs. These payloads may be stored and later execute in the application origin when a reader clicks the rendered content.

CVE-2026-116169: SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What payload locations should be reviewed when investigating possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What payload locations should be reviewed when investigating possible exploitation?