SiYuan Note CVE-2026-116169

Requires an attacker who already holds edit permission on the target document (collaborator/insider) in a workspace where that document is read by others; the payload can be planted via the normal editor or the documented API (POST /api/block/appendBlock with a markdown math block). KaTeX must be in its default trust:true mode on the local-kernel editor path - the condition the advisory names explicitly. Exploitation is further limited by mandatory user interaction: a victim must open the document AND click the rendered link, because javascript: URLs execute only on an in-document click gesture (no click, no execution). Affected: SiYuan 2.10.0 up to (not including) 3.8.7. Not triggered by \script, <img onerror>, HTML blocks, or iframe src (those are escaped/neutralized by Lute); specific to \href/\url/\includegraphics in math blocks, including mixed-case schemes like JaVaScRiPt:.

This is a genuine but moderate-priority issue, not a high-CVSS-but-low-real-risk false alarm, and conversely not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, base 5.1 MEDIUM) and the vuln.today Decision label 'this_month' agree on a measured timeline rather than act_now/emergency. Two signals meaningfully constrain real-world risk: PR:L means the attacker must already hold edit permission on the target document (an insider or invited collaborator, not an anonymous internet attacker), and UI:P means a victim must actively click the rendered link - javascript: URLs fire only on an in-document click gesture, so a merely-viewed document is not exploited. The impact metrics push all vulnerable-system impacts to none (VC:N/VI:N/VA:N) and place the real effect on the subsequent system (SC:L/SI:L) - i.e. script execution in the browser/application origin, not compromise of the SiYuan kernel itself. There is no CISA KEV listing (not actively exploited) and no EPSS score was supplied, so widespread opportunistic exploitation cannot be inferred; the threat model is a malicious or compromised collaborator in a shared/multi-reader workspace. A detailed, reproduced PoC does exist (see exploitation status below), which raises practical exploitability above a theoretical finding. Net: patch on a normal cadence; prioritize sooner only for deployments where documents are shared across semi-trusted users.

A collaborator holding edit permission on a shared SiYuan document stores a math block such as $$\href{javascript:alert('xss')}{clickme}$$, which Lute saves verbatim and mathRender later renders with KaTeX trust:true, producing an <a href="javascript:..."> assigned via innerHTML. When another reader opens the document and clicks the rendered 'clickme' link, the attacker's script runs in the application origin and can act with that reader's session against the local kernel APIs. The GHSA advisory documents a working PoC reproduced end-to-end in a real Chromium against a running SiYuan 3.8.5 instance; exploitation requires the single victim click (AC:L/AT:N but UI:P).