CVE-2026-82654 — SiYuan before v3.8.1 Stored XSS via block name
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to conta…
Published: 2026-08-30 · CVSS: 9.3 · CVSS 4.0
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7