Live › vulnerability › CVE-2026-116167
Go to dashboardSiYuan versions 2.9.0 before 3.8.7 have a cross-site scripting flaw in the unauthenticated /check-auth page, which assigns the 'to' parameter to window.location.href without checking the scheme. A crafted link with a javascript: URI runs script in the victim's session after login, and that script can call kernel APIs to read or change workspace content and settings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Anyone running SiYuan from 2.9.0 before 3.8.7, including self-hosted instances and desktop installs that load the /check-auth page. The attack needs a victim to open a crafted link, and the script then runs with that user's session. Instances already on 3.8.7 or later are not affected.
No product ranges from the sources yet.
3.8.7.3.8.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.
This page as .md · .json · in your agent: get_signal("CVE-2026-116167")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.