CVE-2026-116167— SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

Quick assessment

Affected

siyuan-note siyuan

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SiYuan 版本从 2.9.0 到 3.8.7（不含 3.8.7）存在跨站脚本（XSS）漏洞。该漏洞位于未认证的页面：该页面将参数直接赋值给，且未进行协议（scheme）验证。攻击者可构造包含 URI 的恶意链接，在受害者登录后执行，进而调用内核 API 读取或修改工作区的内容与设置。

CVSS 6.8 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
siyuan-note	siyuan	2.9.0 ~ 3.8.7	-

II. Public POCs for CVE-2026-116167

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116167

请登录查看更多情报信息。

Other References for CVE-2026-116167 (2)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4w vendor-advisory
https://www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameter third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116167

Same Patch Batch · siyuan-note · 2026-10-25 · 6 CVEs total

CVE-2026-116171	7.5 HIGH	SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix
CVE-2026-116166	6.8 MEDIUM	SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting
CVE-2026-116168	6.2 MEDIUM	SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool
CVE-2026-116169	5.4 MEDIUM	SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks
CVE-2026-116170	4.9 MEDIUM	SiYuan before v3.8.7 SQL Injection via History Search op and query

IV. Related Vulnerabilities

Same product: siyuan

Same vendor: siyuan-note

Same weakness: CWE-79