CVE-2026-82653
Received Received - Intake

Stored XSS in SiYuan via Malicious Bazaar Package Names

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulnCheck

Description
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82653
EUVD
EUVD-2026-68239

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82653 is a stored cross-site scripting (XSS) vulnerability in SiYuan note-taking app versions 3.8.0 and earlier. It occurs in the confirmDialog() function where unescaped package names and notebook names are directly inserted into innerHTML assignments without sanitization. Attackers can exploit this by submitting malicious Bazaar packages with HTML/script payloads in the name field. When users uninstall these packages or unlock encrypted notebooks, the payloads execute in their browsers.

Detection Guidance

Check SiYuan application versions. If running v3.8.0 or earlier, the system is vulnerable. Inspect bazaar packages for malicious names containing HTML/script payloads. Look for unusual dialog prompts during package uninstallation or notebook unlocking.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into your SiYuan application. When you interact with affected packages or notebooks, the injected scripts execute in your browser. Since SiYuan's Electron build historically ran with nodeIntegration enabled, these scripts could potentially gain elevated privileges and execute code outside the browser sandbox, leading to full system compromise.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or data exfiltration, which would violate GDPR's integrity and confidentiality requirements. For HIPAA-covered entities, it could result in unauthorized access to protected health information, potentially violating the Security Rule. Organizations using SiYuan may need to assess their exposure and implement compensating controls to maintain compliance.

Mitigation Strategies

Upgrade SiYuan to v3.8.1 or later immediately. Remove any suspicious bazaar packages with unusual names. Avoid interacting with untrusted packages or notebooks until patched. Monitor for unexpected script execution in dialogs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart