Medium severity6.8NVD Advisory· Published Oct 25, 2026· Updated Oct 25, 2026

CVE-2026-116167

Description

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.8.7

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4wnvd
www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000