CVE-2026-84803: SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.2 - Compensating control
Block upload/serving of script-capable file extensions that can resolve to executable media types (e.g., .xht, .ehtml, .xsl, .xbl, .rdf) to prevent stored XSS in asset serving when the extension blocklist is incomplete.
Event History
Frequently Asked Questions
Which deployments are affected?
SiYuan versions before 3.8.2 are affected. The issue is in asset serving and concerns uploaded files with script-capable extensions that are not covered by the extension blocklist.
What does an attacker need to exploit this issue?
An attacker needs the ability to upload a crafted asset file, such as one using .xht, .ehtml, .xsl, .xbl, or .rdf. Exploitation also requires a victim to interact with the stored content, as indicated by the required user interaction vector.
What is the likely impact if exploitation succeeds?
A crafted uploaded asset can execute JavaScript in a victim's browser. This can allow theft of API tokens and compromise of SiYuan workspaces, with high impact to confidentiality, integrity, and availability.
How can I identify potentially malicious uploaded assets?
Review uploaded assets for script-capable extensions omitted from the blocklist, including .xht, .ehtml, .xsl, .xbl, and .rdf. Such files may be served with executable media types and should be treated as potentially unsafe.