CVE-2026-116167
Deferred Deferred - Pending Action

SiYuan Unauthenticated XSS in /check-auth Page

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116167
EUVD
EUVD-2026-109428

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan-note siyuan 2.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions 2.9.0 to 3.8.7 have a cross-site scripting (XSS) flaw in the unauthenticated /check-auth page. The vulnerability occurs because the 'to' parameter is assigned to window.location.href without proper scheme validation. Attackers can craft a link using a javascript: URI that executes after a victim logs in. This allows them to invoke kernel APIs to read or modify workspace content and settings.

Detection Guidance

Check for requests to the /check-auth endpoint with a javascript: URI in the to parameter. Monitor browser console logs for unexpected redirects or script executions after accessing this page.

Impact Analysis

An attacker could trick you into clicking a malicious link, leading to unauthorized access to your SiYuan workspace. They may read sensitive notes, modify existing content, or change settings without your consent. This could result in data theft, corruption, or loss of confidentiality and integrity of your workspace data.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's principles of data integrity and confidentiality. For HIPAA, it may risk exposure of protected health information (PHI), leading to compliance breaches. Organizations must address this to maintain regulatory compliance and avoid penalties.

Mitigation Strategies

Upgrade SiYuan to version 3.8.7 or later. Implement input validation to reject javascript: URIs in the to parameter. Restrict access to the /check-auth endpoint if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart