CVE-2026-82654
Last modified
CVE-2026-82654 is a high-severity vulnerability rated 8.9/10 on the CVSS scale. SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | < 3.8.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-82654?
How severe is CVE-2026-82654?
How do I fix CVE-2026-82654?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-82649SiYuan Windows installer before version 3.8.1 (affected vers…7
- CVE-2026-8265A security vulnerability has been detected in Tenda AC6 15.0…7.2
- CVE-2026-82650SiYuan 3.8.0 contains a path traversal / sensitive file expo…4.4
- CVE-2026-82651SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath g…4.9
- CVE-2026-82652SiYuan before v3.8.1 fails to filter invisible-tier content …5.3
- CVE-2026-82653SiYuan before v3.8.1 contains a stored cross-site scripting …8.9
- CVE-2026-82655Admidio before 5.0.12 contains a blind SQL injection vulnera…7.5
- CVE-2026-82656Admidio before 5.0.12 fails to sanitize album names in the p…2.6
- CVE-2026-82657Admidio before 5.0.12 fails to enforce login-only module res…7.5
- CVE-2026-82658Admidio versions before 5.0.12 contain a broken access contr…4.3
- CVE-2026-82659nodemailer before 9.0.1 fails to apply disableFileAccess and…7.1
- CVE-2026-8266A vulnerability was detected in Open5GS up to 2.7.7. This af…6.5
Are you affected by CVE-2026-82654?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST