CVE-2026-84803

CVSS 9.0 (critical) · published 2026-09-02

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

Weakness: CWE-79

Source: NVD CVE-2026-84803

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7h8j-qw37-w46g
• https://www.vulncheck.com/advisories/siyuan-before-3.8.2-stored-xss-via-incomplete-asset-blocklist
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7h8j-qw37-w46g

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.