CVE-2026-82653 — SiYuan before v3.8.1 Stored XSS via confirmDialog
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into inne…
Published: 2026-08-30 · CVSS: 9.3 · CVSS 4.0
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7