VYPR
Vypr IntelligenceAI-generatedAug 30, 2026· 6 CVEs

Siyuan Note: Batch of Six Vulnerabilities Includes High-Severity XSS and Path Traversal

Siyuan Note: Six vulnerabilities, including two High severity XSS flaws, disclosed and patched in version 3.8.1.

Key findings

On August 30, 2026, a batch of six vulnerabilities was disclosed for Siyuan Note, a popular knowledge management and note-taking application. The vulnerabilities, all patched in version 3.8.1, range in severity from Medium to High, with two critical flaws carrying a CVSSv3 score of 8.9. These issues primarily affect how the application handles user-supplied data in various rendering functions and file path operations.

Two High severity vulnerabilities, CVE-2026-82654 and CVE-2026-82653, stem from improper escaping of user-controlled input. CVE-2026-82654 allows attackers to inject HTML and script tags into block names, aliases, and memo fields. When these fields are displayed in hints, backlinks, or breadcrumbs, the injected scripts can execute in the context of other users' browsers. Similarly, CVE-2026-82653 involves stored cross-site scripting (XSS) within the confirmDialog() function, where package and notebook names are directly interpolated into innerHTML. Malicious bazaar packages with crafted names can lead to script execution.

Further compounding the security concerns, three Medium severity vulnerabilities were also detailed. CVE-2026-82652 permits anonymous readers to enumerate "invisible-tier" content through SQL embed blocks, attribute-view keys, and attribute-view backlinks, bypassing administrator configurations that intended to keep this content private. CVE-2026-82651 and CVE-2026-82650 both relate to path traversal and sensitive file exposure. CVE-2026-82651 fails to properly apply path guards to history and diff endpoints, allowing authenticated administrators to retrieve historical file data. CVE-2026-82650, found in the RenderTemplate function, allows for path traversal, potentially exposing sensitive files within the workspace.

Finally, CVE-2026-82649, another High severity vulnerability, resides in the Windows installer for Siyuan Note versions 2.0.14 up to, but not including, 3.8.1. This vulnerability arises from an uncontrolled search path element, where the installer invokes system executables like TASKKILL by name instead of their absolute path. This allows for potential hijacking of these commands through manipulation of the system's search path.

All six vulnerabilities were addressed in Siyuan Note version 3.8.1. Users are strongly advised to update to this latest version to mitigate the risks associated with these security flaws. The timely disclosure and patching of these issues highlight the ongoing efforts to secure the Siyuan Note ecosystem.

The batch of vulnerabilities disclosed on August 30, 2026, impacts Siyuan Note, with six distinct CVEs identified. The vulnerabilities include stored XSS, path traversal, and information disclosure flaws. Two High severity vulnerabilities (CVE-2026-82654, CVE-2026-82653) stem from improper input sanitization leading to script execution. Three Medium severity vulnerabilities (CVE-2026-82652, CVE-2026-82651, CVE-2026-82650) involve information disclosure and path traversal. A High severity vulnerability in the Windows installer (CVE-2026-82649) is due to an uncontrolled search path element. All identified vulnerabilities are fixed in Siyuan Note version 3.8.1.

AI-written article. Grounded in 6 CVE records listed below.
Siyuan Note: Batch of Six Vulnerabilities Includes High-Severity XSS and Path Traversal · VYPR