EUVD-2026-68240
GHSA-5x6r-p3h7-38vj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated attacker stores payload (PR:L) that runs only when another user views it (UI:R), executing in the victim's context across a trust boundary (S:C) with high confidentiality/integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
AnalysisAI
Stored cross-site scripting in SiYuan before v3.8.1 lets an authenticated user plant HTML/script payloads in a block's name, alias, or memo field, which then execute in another user's session when that user views any document that references or displays the poisoned block via hint, backlink, or breadcrumb rendering. Because the malicious markup runs in the victim's authenticated context, an attacker can hijack sessions and act as the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have a low-privileged authenticated account on the SiYuan instance (PR:L) with the ability to create or edit a block and set its name, alias, or memo field. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L, with subsequent-system SC:H/SI:H) is high, but the raw number should be read against real conditions: exploitation requires an authenticated account (PR:L) and victim interaction (UI:P) - namely a second user opening or viewing a document that surfaces the malicious block. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to SiYuan v3.8.1 or later, which properly escapes the block name, alias, and memo fields in the hint, backlink, and breadcrumb rendering paths; this is the primary and recommended fix per advisory GHSA-hf87-qh3j-3p88 (https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hf87-qh3j-3p88). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today