CVE-2026-82653: SiYuan before v3.8.1 Stored XSS via confirmDialog
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.1 - Compensating control
Mitigate exploitation by avoiding or restricting the actions that trigger confirmation dialogs (e.g., uninstalling packages or unlocking encrypted notebooks) for affected users until SiYuan is upgraded to v3.8.1.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users of SiYuan versions before v3.8.1 are exposed when they uninstall a malicious bazaar package or unlock an encrypted notebook whose name contains a malicious HTML or script payload.
What does an attacker need to do to exploit this issue?
An attacker needs to cause a malicious payload to be stored in a bazaar package name or notebook name. The payload executes when a user opens the affected confirmation dialog, such as during package uninstallation or encrypted-notebook unlocking.
Is user interaction required?
Yes. The affected user must trigger the relevant confirmation dialog by uninstalling the package or unlocking the encrypted notebook.
What version resolves the issue?
The issue affects SiYuan before v3.8.1. Updating to v3.8.1 or later removes the stated affected-version condition.