Live › vulnerability › CVE-2026-116169
Go to dashboardSiYuan notes from 2.10.0 before 3.8.7 let a user with edit permission store javascript: URLs inside math blocks, which KaTeX renders with trust enabled. When another reader clicks the rendered link, the script runs in the SiYuan application origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run SiYuan with multiple users who have edit permission on shared notebooks are exposed, since a stored payload fires for every reader who clicks the link. A single-user install where only the owner edits content has little exposure. Hosted or single-user setups with no other editors can skip it.
No product ranges from the sources yet.
2.10.0 up to but not including 3.8.7 are affected.\href, \url or \includegraphics with javascript: targets in notes that untrusted editors can write to.3.8.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that mathRender assigns via innerHTML, executing script in the application origin when a reader clicks the rendered link.
This page as .md · .json · in your agent: get_signal("CVE-2026-116169")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.