NPM · SEPTEMBER 2026 · CONFIRMED

SiYuan <= v3.8.2: Stored XSS via Incomplete Extension Blocklist

Q: Am I affected?

You are affected if you are running any version of SiYuan from v0.1.0 up to and including v3.8.2-beta.4, as well as various alpha and development versions within that range.

Q: What should I do right now?

Upgrade to SiYuan v3.8.2 or later to mitigate the stored cross-site scripting vulnerability.

Q: How can attackers exploit this vulnerability?

Attackers can upload files with extensions like.xht,.ehtml,.xsl,.xbl, or.rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

Severity: CRITICAL
CVSS: 9
Affected component: siyuan (npm)
Affected versions: >= v3.8.2-beta.4, <= v3.8.2-beta.4 or >= v3.8.2-beta.3, <= v3.8.2-beta.3 or >= v3.8.2-beta.2, <= v3.8.2-beta.2 or >= v3.8.2-beta.1, <= v3.8.2-beta.1 or >= v3.8.2-alpha.6, <= v3.8.2-alpha.6 or >= v3.8.2-alpha.5, <= v3.8.2-alpha.5 or >= v3.8.2-alpha.4, <= v3.8.2-alpha.4 or >= v3.8.2-alpha.3, <= v3.8.2-alpha.3 or >= v3.8.2-alpha.1, <= v3.8.2-alpha.1 or >= v3.8.1, <= v3.8.1 or >= v3.8.1-beta.6, <= v3.8.1-beta.6 or >= v3.8.1-beta.5, <= v3.8.1-beta.5 or >= v3.8.1-beta.4, <= v3.8.1-beta.4 or >= v3.8.1-beta.1, <= v3.8.1-beta.1 or >= v3.8.0, <= v3.8.0 or >= v3.8.0-beta.2, <= v3.8.0-beta.2 or >= v3.8.0-alpha.4, <= v3.8.0-alpha.4 or >= v3.8.0-alpha.3, <= v3.8.0-alpha.3 or >= v3.8.0-alpha.2, <= v3.8.0-alpha.2 or >= v3.7.4-alpha.4, <= v3.7.4-alpha.4 or >= v3.7.4-alpha.2, <= v3.7.4-alpha.2 or >= v3.7.3, <= v3.7.3 or >= v3.7.3-beta.2, <= v3.7.3-beta.2 or >= v3.7.3-beta.1, <= v3.7.3-beta.1 or >= v3.7.0-rc.2, <= v3.7.0-rc.2 or >= v3.7.0-rc.1, <= v3.7.0-rc.1 or >= v3.6.5, <= v3.6.5 or >= v3.7.0-dev12, <= v3.7.0-dev12 or >= v3.7.0-dev8, <= v3.7.0-dev8 or >= v3.7.0-dev5, <= v3.7.0-dev5 or >= v3.7.0-dev2, <= v3.7.0-dev2 or >= v3.6.5-dev2, <= v3.6.5-dev2 or >= v3.6.4, <= v3.6.4 or >= v3.6.4-dev2, <= v3.6.4-dev2 or >= v3.6.3, <= v3.6.3 or >= v3.6.2, <= v3.6.2 or >= v3.6.1, <= v3.6.1 or >= v3.6.0, <= v3.6.0 or >= v3.5.10, <= v3.5.10 or >= v3.5.9, <= v3.5.9 or >= v3.5.8, <= v3.5.8 or >= v3.5.8-dev2, <= v3.5.8-dev2 or >= v3.5.7, <= v3.5.7 or >= v3.5.5, <= v3.5.5 or >= v3.5.4, <= v3.5.4 or >= v3.5.4-dev5, <= v3.5.4-dev5 or >= v3.5.4-dev3, <= v3.5.4-dev3 or >= v3.5.4-dev2, <= v3.5.4-dev2 or >= v3.5.4-dev1, <= v3.5.4-dev1 or >= v3.5.3, <= v3.5.3 or >= v3.5.3-dev5, <= v3.5.3-dev5 or >= v3.5.3-dev4, <= v3.5.3-dev4 or >= v3.5.3-dev3, <= v3.5.3-dev3 or >= v3.5.3-dev2, <= v3.5.3-dev2 or >= v3.5.2, <= v3.5.2 or >= v3.5.2-dev2, <= v3.5.2-dev2 or >= v3.5.2-dev1, <= v3.5.2-dev1 or >= v3.5.1, <= v3.5.1 or >= v3.5.1-dev2, <= v3.5.1-dev2 or >= v3.5.1-dev1, <= v3.5.1-dev1 or >= v3.5.0, <= v3.5.0 or >= v3.5.0-dev2, <= v3.5.0-dev2 or >= v3.5.0-dev1, <= v3.5.0-dev1 or >= v3.4.2, <= v3.4.2 or >= v3.4.2-dev1, <= v3.4.2-dev1 or >= v3.4.1, <= v3.4.1 or >= v3.4.1-dev1, <= v3.4.1-dev1 or >= v3.4.0, <= v3.4.0 or >= v3.4.0-dev5, <= v3.4.0-dev5 or >= v3.4.0-dev4, <= v3.4.0-dev4 or >= v3.4.0-dev3, <= v3.4.0-dev3 or >= v3.4.0-dev2, <= v3.4.0-dev2 or >= v3.4.0-dev1, <= v3.4.0-dev1 or >= v3.3.6, <= v3.3.6 or >= v3.3.6-dev2, <= v3.3.6-dev2 or >= v3.3.6-dev1, <= v3.3.6-dev1 or >= v3.3.5, <= v3.3.5 or >= v3.3.4, <= v3.3.4 or >= v3.3.4-dev2, <= v3.3.4-dev2 or >= v3.3.4-dev1, <= v3.3.4-dev1 or >= v3.3.3, <= v3.3.3 or >= v3.3.3-dev5, <= v3.3.3-dev5 or >= v3.3.3-dev4, <= v3.3.3-dev4 or >= v3.3.3-dev3, <= v3.3.3-dev3 or >= v3.3.3-dev2, <= v3.3.3-dev2 or >= v3.3.3-dev1, <= v3.3.3-dev1 or >= v3.3.2, <= v3.3.2 or >= v3.3.2-dev2, <= v3.3.2-dev2 or >= v3.3.2-dev1, <= v3.3.2-dev1 or >= v3.3.1, <= v3.3.1 or >= v3.3.0, <= v3.3.0 or >= v3.3.0-dev4, <= v3.3.0-dev4 or >= v3.3.0-dev3, <= v3.3.0-dev3 or >= v3.2.1, <= v3.2.1 or >= v3.2.1-dev6, <= v3.2.1-dev6 or >= v3.2.1-dev5, <= v3.2.1-dev5 or >= v3.2.1-dev4, <= v3.2.1-dev4 or >= v3.2.1-dev3, <= v3.2.1-dev3 or >= v3.2.1-dev2, <= v3.2.1-dev2 or >= v3.2.0-dev10, <= v3.2.0-dev10 or >= v3.2.0-dev9, <= v3.2.0-dev9 or >= v3.2.0-dev8, <= v3.2.0-dev8 or >= v3.2.0-dev6, <= v3.2.0-dev6 or >= v3.2.0-dev4, <= v3.2.0-dev4 or >= v3.2.0-dev3, <= v3.2.0-dev3 or >= v3.2.0-dev2, <= v3.2.0-dev2 or >= v3.2.0-dev1, <= v3.2.0-dev1 or >= v3.1.32, <= v3.1.32 or >= v3.1.32-dev2, <= v3.1.32-dev2 or >= v3.1.31, <= v3.1.31 or >= v3.1.30, <= v3.1.30 or >= v3.1.30-dev1, <= v3.1.30-dev1 or >= v3.1.29, <= v3.1.29 or >= v3.1.29-dev3, <= v3.1.29-dev3 or >= v3.1.28, <= v3.1.28 or >= v3.1.28-dev3, <= v3.1.28-dev3 or >= v3.1.28-dev2, <= v3.1.28-dev2 or >= v3.1.27, <= v3.1.27 or >= v3.1.27-dev4, <= v3.1.27-dev4 or >= v3.1.27-dev2, <= v3.1.27-dev2 or >= v3.1.27-dev1, <= v3.1.27-dev1 or >= v3.1.26, <= v3.1.26 or >= v3.1.26-dev3, <= v3.1.26-dev3 or >= v3.1.26-dev2, <= v3.1.26-dev2 or >= v3.1.26-dev1, <= v3.1.26-dev1 or >= v3.1.25, <= v3.1.25 or >= v3.1.25-dev6, <= v3.1.25-dev6 or >= v3.1.25-dev4, <= v3.1.25-dev4 or >= v3.1.25-dev3, <= v3.1.25-dev3 or >= v3.1.24, <= v3.1.24 or >= v3.1.23, <= v3.1.23 or >= v3.1.22, <= v3.1.22 or >= v3.1.22-dev2, <= v3.1.22-dev2 or >= v3.1.22-dev1, <= v3.1.22-dev1 or >= v3.1.21, <= v3.1.21 or >= v3.1.21-dev4, <= v3.1.21-dev4 or >= v3.1.21-dev3, <= v3.1.21-dev3 or >= v3.1.21-dev1, <= v3.1.21-dev1 or >= v3.1.20, <= v3.1.20 or >= v3.1.20-dev4, <= v3.1.20-dev4 or >= v3.1.20-dev3, <= v3.1.20-dev3 or >= v3.1.19, <= v3.1.19 or >= v3.1.19-dev3, <= v3.1.19-dev3 or >= v3.1.18, <= v3.1.18 or >= v3.1.17, <= v3.1.17 or >= v3.1.16, <= v3.1.16 or >= v3.1.15, <= v3.1.15 or >= v3.1.15-dev3, <= v3.1.15-dev3 or >= v3.1.15-dev1, <= v3.1.15-dev1 or >= v3.1.14, <= v3.1.14 or >= v3.1.14-dev2, <= v3.1.14-dev2 or >= v3.1.13, <= v3.1.13 or >= v3.1.12, <= v3.1.12 or >= v3.1.12-dev4, <= v3.1.12-dev4 or >= v3.1.12-dev3, <= v3.1.12-dev3 or >= v3.1.12-dev2, <= v3.1.12-dev2 or >= v3.1.11, <= v3.1.11 or >= v3.1.11-dev9, <= v3.1.11-dev9 or >= v3.1.11-dev5, <= v3.1.11-dev5 or >= v3.1.11-dev2, <= v3.1.11-dev2 or >= v3.1.10, <= v3.1.10 or >= v3.1.10-dev6, <= v3.1.10-dev6 or >= v3.1.10-dev1, <= v3.1.10-dev1 or >= v3.1.9, <= v3.1.9 or >= v3.1.9-dev10, <= v3.1.9-dev10 or >= v3.1.9-dev9, <= v3.1.9-dev9 or >= v3.1.9-dev7, <= v3.1.9-dev7 or >= v3.1.9-dev6, <= v3.1.9-dev6 or >= v3.1.9-dev4, <= v3.1.9-dev4 or >= v3.1.9-dev3, <= v3.1.9-dev3 or >= v3.1.9-dev2, <= v3.1.9-dev2 or >= v3.1.9-dev1, <= v3.1.9-dev1 or >= v3.1.8, <= v3.1.8 or >= v3.1.8-dev3, <= v3.1.8-dev3 or >= v3.1.8-dev2, <= v3.1.8-dev2 or >= v3.1.7, <= v3.1.7 or >= v3.1.7-dev8, <= v3.1.7-dev8 or >= v3.1.7-dev7, <= v3.1.7-dev7 or >= v3.1.7-dev5, <= v3.1.7-dev5 or >= v3.1.7-dev4, <= v3.1.7-dev4 or >= v3.1.7-dev3, <= v3.1.7-dev3 or >= v3.1.6, <= v3.1.6 or >= v3.1.6-dev2, <= v3.1.6-dev2 or >= v3.1.6-dev1, <= v3.1.6-dev1 or >= v3.1.5, <= v3.1.5 or >= v3.1.4, <= v3.1.4 or >= v3.1.4-dev5, <= v3.1.4-dev5 or >= v3.1.4-dev3, <= v3.1.4-dev3 or >= v3.1.4-dev2, <= v3.1.4-dev2 or >= v3.1.3, <= v3.1.3 or >= v3.1.3-dev2, <= v3.1.3-dev2 or >= v3.1.3-dev1, <= v3.1.3-dev1 or >= v3.1.2, <= v3.1.2 or >= v3.1.2-dev4, <= v3.1.2-dev4 or >= v3.1.2-dev3, <= v3.1.2-dev3 or >= v3.1.2-dev2, <= v3.1.2-dev2 or >= v3.1.1-dev2, <= v3.1.1-dev2 or >= v3.1.1-dev1, <= v3.1.1-dev1 or >= v3.1.0, <= v3.1.0 or >= v3.1.0-dev12, <= v3.1.0-dev12 or >= v3.1.0-dev11, <= v3.1.0-dev11 or >= v3.1.0-dev10, <= v3.1.0-dev10 or >= v3.1.0-dev9, <= v3.1.0-dev9 or >= v3.1.0-dev8, <= v3.1.0-dev8 or >= v3.1.0-dev3, <= v3.1.0-dev3 or >= v3.1.0-dev2, <= v3.1.0-dev2 or >= v3.0.17, <= v3.0.17 or >= v3.0.17-dev2, <= v3.0.17-dev2 or >= v3.0.17-dev1, <= v3.0.17-dev1 or >= v3.0.16, <= v3.0.16 or >= v3.0.16-dev3, <= v3.0.16-dev3 or >= v3.0.15, <= v3.0.15 or >= v3.0.15-dev2, <= v3.0.15-dev2 or >= v3.0.15-dev1, <= v3.0.15-dev1 or >= v3.0.14, <= v3.0.14 or >= v3.0.13-dev4, <= v3.0.13-dev4 or >= v3.0.13-dev3, <= v3.0.13-dev3 or >= v3.0.12, <= v3.0.12 or >= v3.0.12-dev5, <= v3.0.12-dev5 or >= v3.0.12-dev4, <= v3.0.12-dev4 or >= v3.0.12-dev1, <= v3.0.12-dev1 or >= v3.0.11, <= v3.0.11 or >= v3.0.10, <= v3.0.10 or >= v3.0.10-dev3, <= v3.0.10-dev3 or >= v3.0.10-dev1, <= v3.0.10-dev1 or >= v3.0.9, <= v3.0.9 or >= v3.0.8, <= v3.0.8 or >= v3.0.8-dev2, <= v3.0.8-dev2 or >= v3.0.8-dev1, <= v3.0.8-dev1 or >= v3.0.7, <= v3.0.7 or >= v3.0.7-dev1, <= v3.0.7-dev1 or >= v3.0.6, <= v3.0.6 or >= v3.0.6-dev3, <= v3.0.6-dev3 or >= v3.0.6-dev2, <= v3.0.6-dev2 or >= v3.0.5, <= v3.0.5 or >= v3.0.5-dev5, <= v3.0.5-dev5 or >= v3.0.5-dev4, <= v3.0.5-dev4 or >= v3.0.5-dev3, <= v3.0.5-dev3 or >= v3.0.4, <= v3.0.4 or >= v3.0.4-dev2, <= v3.0.4-dev2 or >= v3.0.3, <= v3.0.3 or >= v3.0.3-dev5, <= v3.0.3-dev5 or >= v3.0.3-dev4, <= v3.0.3-dev4 or >= v3.0.2, <= v3.0.2 or >= v3.0.2-dev2, <= v3.0.2-dev2 or >= v3.0.1, <= v3.0.1 or >= v3.0.1-dev2, <= v3.0.1-dev2 or >= v3.0.0, <= v3.0.0 or >= v3.0.0-dev2, <= v3.0.0-dev2 or >= v3.0.0-dev1, <= v3.0.0-dev1 or >= v2.12.8, <= v2.12.8 or >= v2.12.8-dev2, <= v2.12.8-dev2 or >= v2.12.7, <= v2.12.7 or >= v2.12.7-dev2, <= v2.12.7-dev2 or >= v2.12.7-dev1, <= v2.12.7-dev1 or >= v2.12.6, <= v2.12.6 or >= v2.12.5, <= v2.12.5 or >= v2.12.4, <= v2.12.4 or >= v2.12.4-dev2, <= v2.12.4-dev2 or >= v2.12.3, <= v2.12.3 or >= v2.12.3-dev2, <= v2.12.3-dev2 or >= v2.12.2, <= v2.12.2 or >= v2.12.1, <= v2.12.1 or >= v2.12.1-dev3, <= v2.12.1-dev3 or >= v2.12.0, <= v2.12.0 or >= v2.12.0-dev1, <= v2.12.0-dev1 or >= v2.11.4, <= v2.11.4 or >= v2.11.4-dev6, <= v2.11.4-dev6 or >= v2.11.4-dev5, <= v2.11.4-dev5 or >= v2.11.4-dev4, <= v2.11.4-dev4 or >= v2.11.4-dev2, <= v2.11.4-dev2 or >= v2.11.3, <= v2.11.3 or >= v2.11.3-dev2, <= v2.11.3-dev2 or >= v2.11.3-dev1, <= v2.11.3-dev1 or >= v2.11.2, <= v2.11.2 or >= v2.11.2-dev5, <= v2.11.2-dev5 or >= v2.11.2-dev4, <= v2.11.2-dev4 or >= v2.11.2-dev3, <= v2.11.2-dev3 or >= v2.11.2-dev2, <= v2.11.2-dev2 or >= v2.11.2-dev1, <= v2.11.2-dev1 or >= v2.11.1, <= v2.11.1 or >= v2.11.1-dev1, <= v2.11.1-dev1 or >= v2.11.0, <= v2.11.0 or >= v2.11.0-dev2, <= v2.11.0-dev2 or >= v2.10.16, <= v2.10.16 or >= v2.10.16-dev2, <= v2.10.16-dev2 or >= v2.10.15, <= v2.10.15 or >= v2.10.15-dev1, <= v2.10.15-dev1 or >= v2.10.14, <= v2.10.14 or >= v2.10.14-dev2, <= v2.10.14-dev2 or >= v2.10.14-dev1, <= v2.10.14-dev1 or >= v2.10.13, <= v2.10.13 or >= v2.10.13-dev5, <= v2.10.13-dev5 or >= v2.10.13-dev1, <= v2.10.13-dev1 or >= v2.10.12, <= v2.10.12 or >= v2.10.12-dev1, <= v2.10.12-dev1 or >= v2.10.11, <= v2.10.11 or >= v2.10.11-dev2, <= v2.10.11-dev2 or >= v2.10.10, <= v2.10.10 or >= v2.10.9, <= v2.10.9 or >= v2.10.9-dev3, <= v2.10.9-dev3 or >= v2.10.8, <= v2.10.8 or >= v2.10.8-dev3, <= v2.10.8-dev3 or >= v2.10.8-dev2, <= v2.10.8-dev2 or >= v2.10.8-dev1, <= v2.10.8-dev1 or >= v2.10.6, <= v2.10.6 or >= v2.10.6-dev4, <= v2.10.6-dev4 or >= v2.10.6-dev3, <= v2.10.6-dev3 or >= v2.10.6-dev2, <= v2.10.6-dev2 or >= v2.10.6-dev1, <= v2.10.6-dev1 or >= v2.10.5, <= v2.10.5 or >= v2.10.5-dev2, <= v2.10.5-dev2 or >= v2.10.5-dev1, <= v2.10.5-dev1 or >= v2.10.4, <= v2.10.4 or >= v2.10.4-dev1, <= v2.10.4-dev1 or >= v2.10.3, <= v2.10.3 or >= v2.10.3-dev3, <= v2.10.3-dev3 or >= v2.10.3-dev2, <= v2.10.3-dev2 or >= v2.10.3-dev1, <= v2.10.3-dev1 or >= v2.10.2, <= v2.10.2 or >= v2.10.1, <= v2.10.1 or >= v2.10.1-dev1, <= v2.10.1-dev1 or >= v2.10.0, <= v2.10.0 or >= v2.9.9, <= v2.9.9 or >= v2.9.9-dev1, <= v2.9.9-dev1 or >= v2.9.8, <= v2.9.8 or >= v2.9.8-dev2, <= v2.9.8-dev2 or >= v2.9.8-dev1, <= v2.9.8-dev1 or >= v2.9.7, <= v2.9.7 or >= v2.9.7-dev3, <= v2.9.7-dev3 or >= v2.9.7-dev2, <= v2.9.7-dev2 or >= v2.9.6, <= v2.9.6 or >= v2.9.6-dev1, <= v2.9.6-dev1 or >= v2.9.5, <= v2.9.5 or >= v2.9.5-dev2, <= v2.9.5-dev2 or >= v2.9.4, <= v2.9.4 or >= v2.9.4-dev2, <= v2.9.4-dev2 or >= v2.9.3, <= v2.9.3 or >= v2.9.3-dev3, <= v2.9.3-dev3 or >= v2.9.3-dev1, <= v2.9.3-dev1 or >= v2.9.2, <= v2.9.2 or >= v2.9.2-dev3, <= v2.9.2-dev3 or >= v2.9.2-dev2, <= v2.9.2-dev2 or >= v2.9.1, <= v2.9.1 or >= v2.9.1-dev2, <= v2.9.1-dev2 or >= v2.9.1-dev1, <= v2.9.1-dev1 or >= v2.9.0, <= v2.9.0 or >= v2.9.0-dev1, <= v2.9.0-dev1 or >= v2.8.10, <= v2.8.10 or >= v2.8.9, <= v2.8.9 or >= v2.8.9-dev3, <= v2.8.9-dev3 or >= v2.8.9-dev2, <= v2.8.9-dev2 or >= v2.8.8, <= v2.8.8 or >= v2.8.8-dev3, <= v2.8.8-dev3 or >= v2.8.8-dev1, <= v2.8.8-dev1 or >= v2.8.7, <= v2.8.7 or >= v2.8.7-dev5, <= v2.8.7-dev5 or >= v2.8.7-dev3, <= v2.8.7-dev3 or >= v2.8.7-dev2, <= v2.8.7-dev2 or >= v2.8.6, <= v2.8.6 or >= v2.8.6-dev4, <= v2.8.6-dev4 or >= v2.8.6-dev2, <= v2.8.6-dev2 or >= v2.8.6-dev1, <= v2.8.6-dev1 or >= v2.8.5, <= v2.8.5 or >= v2.8.5-dev3, <= v2.8.5-dev3 or >= v2.8.5-dev2, <= v2.8.5-dev2 or >= v2.8.5-dev1, <= v2.8.5-dev1 or >= v2.8.4, <= v2.8.4 or >= v2.8.4-dev2, <= v2.8.4-dev2 or >= v2.8.3, <= v2.8.3 or >= v2.8.3-dev1, <= v2.8.3-dev1 or >= v2.8.1-dev3, <= v2.8.1-dev3 or >= v2.8.1-dev2, <= v2.8.1-dev2 or >= v2.8.1-dev1, <= v2.8.1-dev1 or >= v2.8.0, <= v2.8.0 or >= v2.8.0-dev1, <= v2.8.0-dev1 or >= v2.7.10, <= v2.7.10 or >= v2.7.9-dev2, <= v2.7.9-dev2 or >= v2.7.9-dev1, <= v2.7.9-dev1 or >= v2.7.9, <= v2.7.9 or >= v2.7.8, <= v2.7.8 or >= v2.7.8-dev1, <= v2.7.8-dev1 or >= v2.7.7, <= v2.7.7 or >= v2.7.7-dev4, <= v2.7.7-dev4 or >= v2.7.7-dev3, <= v2.7.7-dev3 or >= v2.7.7-dev2, <= v2.7.7-dev2 or >= v2.7.7-dev1, <= v2.7.7-dev1 or >= v2.7.6, <= v2.7.6 or >= v2.7.6-dev4, <= v2.7.6-dev4 or >= v2.7.6-dev3, <= v2.7.6-dev3 or >= v2.7.5, <= v2.7.5 or >= v2.7.5-dev2, <= v2.7.5-dev2 or >= v2.7.4, <= v2.7.4 or >= v2.7.4-dev1, <= v2.7.4-dev1 or >= v2.7.3, <= v2.7.3 or >= v2.7.3-dev4, <= v2.7.3-dev4 or >= v2.7.3-dev3, <= v2.7.3-dev3 or >= v2.7.2, <= v2.7.2 or >= v2.7.2-dev3, <= v2.7.2-dev3 or >= v2.7.2-dev2, <= v2.7.2-dev2 or >= v2.7.2-dev1, <= v2.7.2-dev1 or >= v2.7.1, <= v2.7.1 or >= v2.7.1-dev5, <= v2.7.1-dev5 or >= v2.7.1-dev1, <= v2.7.1-dev1 or >= v2.7.0, <= v2.7.0 or >= v2.6.3, <= v2.6.3 or >= v2.6.3-dev6, <= v2.6.3-dev6 or >= v2.6.3-dev4, <= v2.6.3-dev4 or >= v2.6.3-dev3, <= v2.6.3-dev3 or >= v2.6.3-dev2, <= v2.6.3-dev2 or >= v2.6.3-dev1, <= v2.6.3-dev1 or >= v2.6.2, <= v2.6.2 or >= v2.6.1, <= v2.6.1 or >= v2.6.1-dev7, <= v2.6.1-dev7 or >= v2.6.1-dev6, <= v2.6.1-dev6 or >= v2.6.1-dev5, <= v2.6.1-dev5 or >= v2.6.1-dev4, <= v2.6.1-dev4 or >= v2.6.1-dev3, <= v2.6.1-dev3 or >= v2.6.0, <= v2.6.0 or >= v2.6.0-dev3, <= v2.6.0-dev3 or >= v2.6.0-dev2, <= v2.6.0-dev2 or >= v2.6.0-dev1, <= v2.6.0-dev1 or >= v2.5.5, <= v2.5.5 or >= v2.5.5-dev1, <= v2.5.5-dev1 or >= v2.5.4, <= v2.5.4 or >= v2.5.4-dev1, <= v2.5.4-dev1 or >= v2.5.3, <= v2.5.3 or >= v2.5.3-dev2, <= v2.5.3-dev2 or >= v2.5.2, <= v2.5.2 or >= v2.5.2-dev2, <= v2.5.2-dev2 or >= v2.5.1, <= v2.5.1 or >= v2.5.1-dev2, <= v2.5.1-dev2 or >= v2.5.1-dev1, <= v2.5.1-dev1 or >= v2.5.0, <= v2.5.0 or >= v2.5.0-dev2, <= v2.5.0-dev2 or >= v2.5.0-dev1, <= v2.5.0-dev1 or >= v2.4.12, <= v2.4.12 or >= v2.4.12-dev2, <= v2.4.12-dev2 or >= v2.4.11, <= v2.4.11 or >= v2.4.10, <= v2.4.10 or >= v2.4.9, <= v2.4.9 or >= v2.4.8, <= v2.4.8 or >= v2.4.7, <= v2.4.7 or >= v2.4.6, <= v2.4.6 or >= v2.4.5, <= v2.4.5 or >= v2.4.4, <= v2.4.4 or >= v2.4.3, <= v2.4.3 or >= v2.4.2, <= v2.4.2 or >= v2.4.1, <= v2.4.1 or >= v2.4.0, <= v2.4.0 or >= v2.3.3, <= v2.3.3 or >= v2.3.2, <= v2.3.2 or >= v2.3.1, <= v2.3.1 or >= v2.3.0, <= v2.3.0 or >= v2.2.3, <= v2.2.3 or >= v2.2.2, <= v2.2.2 or >= v2.2.1, <= v2.2.1 or >= v2.2.0, <= v2.2.0 or >= v2.1.14, <= v2.1.14 or >= v2.1.13, <= v2.1.13 or >= v2.1.12, <= v2.1.12 or >= v2.1.11, <= v2.1.11 or >= v2.1.10, <= v2.1.10 or >= v2.1.9, <= v2.1.9 or >= v2.1.8, <= v2.1.8 or >= v2.1.8-dev1, <= v2.1.8-dev1 or >= v2.1.7, <= v2.1.7 or >= v2.1.6, <= v2.1.6 or >= v2.1.6-dev1, <= v2.1.6-dev1 or >= v2.1.5, <= v2.1.5 or >= v2.1.4, <= v2.1.4 or >= v2.1.3, <= v2.1.3 or >= v2.1.3-dev1, <= v2.1.3-dev1 or >= v2.1.2, <= v2.1.2 or >= v2.1.1, <= v2.1.1 or >= v2.1.0, <= v2.1.0 or >= v2.0.27, <= v2.0.27 or >= v2.0.26, <= v2.0.26 or >= v2.0.26-dev2, <= v2.0.26-dev2 or >= v2.0.26-dev1, <= v2.0.26-dev1 or >= v2.0.25, <= v2.0.25 or >= v2.0.24, <= v2.0.24 or >= v2.0.23, <= v2.0.23 or >= v2.0.22, <= v2.0.22 or >= v2.0.21, <= v2.0.21 or >= v2.0.21-dev1, <= v2.0.21-dev1 or >= v2.0.20, <= v2.0.20 or >= v2.0.19, <= v2.0.19 or >= v2.0.18, <= v2.0.18 or >= v2.0.17, <= v2.0.17 or >= dev2.0.17-2, <= dev2.0.17-2 or >= v2.0.16, <= v2.0.16 or >= v2.0.15, <= v2.0.15 or >= v2.0.14, <= v2.0.14 or >= v2.0.13, <= v2.0.13 or >= v2.0.12, <= v2.0.12 or >= v2.0.11, <= v2.0.11 or >= v2.0.10, <= v2.0.10 or >= v2.0.9, <= v2.0.9 or >= v2.0.8, <= v2.0.8 or >= v2.0.7, <= v2.0.7 or >= v2.0.6, <= v2.0.6 or >= v2.0.5, <= v2.0.5 or >= v2.0.4, <= v2.0.4 or >= v2.0.3, <= v2.0.3 or >= v2.0.2, <= v2.0.2 or >= v2.0.1, <= v2.0.1 or >= v2.0.0, <= v2.0.0 or >= v2.0.0-beta2, <= v2.0.0-beta2 or >= v2.0.0-beta1, <= v2.0.0-beta1 or >= v1.9.9, <= v1.9.9 or >= v1.9.8, <= v1.9.8 or >= v1.9.7, <= v1.9.7 or >= v1.9.6, <= v1.9.6 or >= v1.9.5, <= v1.9.5 or >= v1.9.4, <= v1.9.4 or >= v1.9.3, <= v1.9.3 or >= v1.9.2, <= v1.9.2 or >= v1.9.1, <= v1.9.1 or >= v1.9.0, <= v1.9.0 or >= v1.8.9, <= v1.8.9 or >= v1.8.8, <= v1.8.8 or >= v1.8.7, <= v1.8.7 or >= v1.8.6, <= v1.8.6 or >= v1.8.5, <= v1.8.5 or >= v1.8.4, <= v1.8.4 or >= v1.8.2, <= v1.8.2 or >= v1.8.1, <= v1.8.1 or >= v1.8.0, <= v1.8.0 or >= v1.7.11, <= v1.7.11 or >= v1.7.10, <= v1.7.10 or >= v1.7.9, <= v1.7.9 or >= v1.7.8, <= v1.7.8 or >= v1.7.7, <= v1.7.7 or >= v1.7.6, <= v1.7.6 or >= v1.7.5, <= v1.7.5 or >= v1.7.4, <= v1.7.4 or >= v1.7.3, <= v1.7.3 or >= v1.7.2, <= v1.7.2 or >= v1.7.1, <= v1.7.1 or >= v1.7.0, <= v1.7.0 or >= v1.6.3, <= v1.6.3 or >= v1.6.2, <= v1.6.2 or >= v1.6.1, <= v1.6.1 or >= v1.6.0, <= v1.6.0 or >= v1.5.6, <= v1.5.6 or >= v1.5.5, <= v1.5.5 or >= v1.5.5-beta3, <= v1.5.5-beta3 or >= v1.5.5-beta2, <= v1.5.5-beta2 or >= v1.5.5-beta1, <= v1.5.5-beta1 or >= v1.5.4, <= v1.5.4 or >= v1.5.3, <= v1.5.3 or >= v1.5.2, <= v1.5.2 or >= v1.5.1, <= v1.5.1 or >= v1.5.0, <= v1.5.0 or >= v1.4.8, <= v1.4.8 or >= v1.4.7, <= v1.4.7 or >= v1.4.6, <= v1.4.6 or >= v1.4.5, <= v1.4.5 or >= v1.4.4, <= v1.4.4 or >= v1.4.3, <= v1.4.3 or >= v1.4.2, <= v1.4.2 or >= v1.4.1, <= v1.4.1 or >= v1.4.0, <= v1.4.0 or >= v1.3.9, <= v1.3.9 or >= v1.3.8, <= v1.3.8 or >= v1.3.7, <= v1.3.7 or >= v1.3.6, <= v1.3.6 or >= v1.3.5, <= v1.3.5 or >= v1.3.4, <= v1.3.4 or >= v1.3.3, <= v1.3.3 or >= v1.3.2, <= v1.3.2 or >= v1.3.1, <= v1.3.1 or >= v1.3.0, <= v1.3.0 or >= v1.2.9, <= v1.2.9 or >= v1.2.8, <= v1.2.8 or >= v1.2.7, <= v1.2.7 or >= v1.2.6, <= v1.2.6 or >= v1.2.5, <= v1.2.5 or >= v1.2.31, <= v1.2.31 or >= v1.2.3, <= v1.2.3 or >= v1.2.2, <= v1.2.2 or >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.2.0-rc3, <= v1.2.0-rc3 or >= v1.2.0-rc2, <= v1.2.0-rc2 or >= v1.2.0-rc1, <= v1.2.0-rc1 or >= v1.2.0-beta16, <= v1.2.0-beta16 or >= v1.2.0-beta15, <= v1.2.0-beta15 or >= v1.2.0-beta14, <= v1.2.0-beta14 or >= v1.2.0-beta13, <= v1.2.0-beta13 or >= v1.2.0-beta12, <= v1.2.0-beta12 or >= v1.2.0-beta11, <= v1.2.0-beta11 or >= v1.2.0-beta10, <= v1.2.0-beta10 or >= v1.2.0-beta9, <= v1.2.0-beta9 or >= v1.2.0-beta8, <= v1.2.0-beta8 or >= v1.2.0-beta7, <= v1.2.0-beta7 or >= v1.2.0-beta6, <= v1.2.0-beta6 or >= v1.2.0-beta5, <= v1.2.0-beta5 or >= v1.2.0-beta4, <= v1.2.0-beta4 or >= v1.2.0-beta3, <= v1.2.0-beta3 or >= v1.2.0-beta2, <= v1.2.0-beta2 or >= v1.2.0-beta1, <= v1.2.0-beta1 or >= v1.1.83, <= v1.1.83 or >= v1.1.82, <= v1.1.82 or >= v1.1.81, <= v1.1.81 or >= v1.1.8, <= v1.1.8 or >= v1.1.7, <= v1.1.7 or >= v1.1.6, <= v1.1.6 or >= v1.1.5, <= v1.1.5 or >= v1.1.4, <= v1.1.4 or >= v1.1.3, <= v1.1.3 or >= v1.1.2, <= v1.1.2 or >= v1.1.1, <= v1.1.1 or >= v1.1.0, <= v1.1.0 or >= v1.0.9, <= v1.0.9 or >= v1.0.8, <= v1.0.8 or >= v1.0.7, <= v1.0.7 or >= v1.0.6, <= v1.0.6 or >= v1.0.5, <= v1.0.5 or >= v1.0.4, <= v1.0.4 or >= v1.0.3, <= v1.0.3 or >= v1.0.2, <= v1.0.2 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= v0.9.9, <= v0.9.9 or >= v0.9.8, <= v0.9.8 or >= v0.9.7, <= v0.9.7 or >= v0.9.6, <= v0.9.6 or >= v0.9.5, <= v0.9.5 or >= v0.9.2, <= v0.9.2 or >= v0.9.0, <= v0.9.0 or >= v0.8.5, <= v0.8.5 or >= v0.8.0, <= v0.8.0 or >= v0.7.8, <= v0.7.8 or >= v0.7.5, <= v0.7.5 or >= v0.7.1, <= v0.7.1 or >= v0.7.0, <= v0.7.0 or >= v0.6.8, <= v0.6.8 or >= v0.6.7, <= v0.6.7 or >= v0.6.6, <= v0.6.6 or >= v0.6.5, <= v0.6.5 or >= v0.6.4, <= v0.6.4 or >= v0.6.3, <= v0.6.3 or >= v0.6.2, <= v0.6.2 or >= v0.6.1, <= v0.6.1 or >= v0.6.0, <= v0.6.0 or >= v0.5.9, <= v0.5.9 or >= v0.5.8, <= v0.5.8 or >= v0.5.7, <= v0.5.7 or >= v0.5.6, <= v0.5.6 or >= v0.5.6-alpha1, <= v0.5.6-alpha1 or >= v0.5.5, <= v0.5.5 or >= v0.5.46, <= v0.5.46 or >= v0.5.45, <= v0.5.45 or >= v0.5.44, <= v0.5.44 or >= v0.5.43, <= v0.5.43 or >= v0.5.42, <= v0.5.42 or >= v0.5.41, <= v0.5.41 or >= v0.5.4, <= v0.5.4 or >= v0.5.3, <= v0.5.3 or >= v0.5.2, <= v0.5.2 or >= v0.5.1, <= v0.5.1 or >= v0.5.0, <= v0.5.0 or >= v0.4.94, <= v0.4.94 or >= v0.4.93, <= v0.4.93 or >= v0.4.92, <= v0.4.92 or >= v0.4.91, <= v0.4.91 or >= v0.4.9, <= v0.4.9 or >= v0.4.8, <= v0.4.8 or >= v0.4.7, <= v0.4.7 or >= v0.4.6, <= v0.4.6 or >= v0.4.5, <= v0.4.5 or >= v0.4.4, <= v0.4.4 or >= v0.4.32, <= v0.4.32 or >= v0.4.3-x1, <= v0.4.3-x1 or >= v0.4.3, <= v0.4.3 or >= v0.4.2, <= v0.4.2 or >= v0.4.1-x2, <= v0.4.1-x2 or >= v0.4.1, <= v0.4.1 or >= v0.4.0, <= v0.4.0 or >= v0.3.9, <= v0.3.9 or >= v0.3.8, <= v0.3.8 or >= v0.3.7, <= v0.3.7 or >= v0.3.6, <= v0.3.6 or >= v0.3.5, <= v0.3.5 or >= v0.3.4, <= v0.3.4 or >= v0.3.3, <= v0.3.3 or >= v0.3.2, <= v0.3.2 or >= v0.3.1, <= v0.3.1 or >= v0.3.0, <= v0.3.0 or >= v0.2.9, <= v0.2.9 or >= v0.2.8, <= v0.2.8 or >= v0.2.7, <= v0.2.7 or >= v0.2.6, <= v0.2.6 or >= v0.2.5, <= v0.2.5 or >= v0.2.4, <= v0.2.4 or >= v0.2.3, <= v0.2.3 or >= v0.2.2, <= v0.2.2 or >= v0.2.1, <= v0.2.1 or >= v0.2.0, <= v0.2.0 or >= v0.1.9, <= v0.1.9 or >= v0.1.8, <= v0.1.8 or >= v0.1.7, <= v0.1.7 or >= v0.1.6, <= v0.1.6 or >= v0.1.5, <= v0.1.5 or >= v0.1.4, <= v0.1.4 or >= v0.1.3, <= v0.1.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1 or >= v0.1.0, <= v0.1.0
Patched version: 3.8.2

CVE-2026-84803

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like.xht,.ehtml,.xsl,.xbl, or.rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

What happened

The vulnerability arises from an incomplete extension blocklist in SiYuan's asset serving mechanism. This blocklist fails to restrict certain script-capable file types, allowing attackers to upload files with extensions like.xht,.ehtml,.xsl,.xbl, or.rdf. These files resolve to executable media types and can execute JavaScript, leading to stored cross-site scripting attacks. Attackers can exploit this to steal API tokens and compromise workspaces.

The vulnerability affects all versions of SiYuan from v0.1.0 up to and including v3.8.2-beta.4, as well as various alpha and development versions within that range. The issue has been confirmed and tracked under CVE-2026-84803.

What to do about it

Upgrade to SiYuan v3.8.2 or later to mitigate the stored cross-site scripting vulnerability.
Review your SiYuan installation and ensure it is running a patched version.
Monitor the primary sources for any updates or additional patches related to this vulnerability.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are running any version of SiYuan from v0.1.0 up to and including v3.8.2-beta.4, as well as various alpha and development versions within that range.

What should I do right now?

Upgrade to SiYuan v3.8.2 or later to mitigate the stored cross-site scripting vulnerability.

How can attackers exploit this vulnerability?

Attackers can upload files with extensions like.xht,.ehtml,.xsl,.xbl, or.rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

Sources

Join the 0Day waitlist →

← Back to all threats