SiYuan EUVD-2026-109428

Exploitation targets the unauthenticated /check-auth page of the SiYuan kernel (default port 6806), which reads the 'to' query parameter (app/stage/auth.html) and assigns it to window.location.href on login success without scheme validation. Concrete prerequisites: the attacker must deliver a crafted link containing a javascript: URI in 'to' to the victim, AND the victim must (a) open that link and (b) complete a valid login by entering their access auth code and submitting on that page - the script only runs after loginAuth returns code 0. Limiting factors that reduce realistic risk: mandatory two-step user interaction (open plus authenticate), network reachability to the victim's kernel, and the instance having access auth enabled; full read/modify of workspace content and kernel settings requires the authenticating victim to be an administrator. This is reflected, not stored, so no persistence exists between sessions.

The input CVSS 4.0 base score is 7.6 (High) with vector AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N. PR:N reflects that the /check-auth page is served without authentication, so the attacker themselves needs no credentials; however AC:H, AT:P and UI:P together signal substantial constraints: the attack only succeeds if the victim opens the attacker-crafted link AND completes a valid login on that page. This is a reflected (non-stored) XSS, so there is no persistent trigger and each exploitation depends on social engineering. No EPSS score and no CISA KEV status were provided in the input, so widespread-exploitation probability cannot be quantified from the data; absence of KEV means there is no evidence of active exploitation. A public PoC reference exists in the GHSA advisory and was verified end to end by the reporter on v3.8.6, which raises practical feasibility above purely theoretical. The vuln.today decision label is 'this_week', consistent with a genuine but user-interaction-gated issue rather than an emergency. Net: this is a real, patch-this-week priority for exposed SiYuan instances, but the heavy user-interaction precondition (open link plus authenticate) keeps real-world mass-exploitation risk below what the High score alone might suggest.

An attacker sends a victim a phishing link pointing at the victim's SiYuan kernel, e.g. http://<host>:6806/check-auth?to=javascript:<payload>, where the to parameter carries a javascript: URI. When the victim opens the unauthenticated /check-auth page and enters their valid access auth code, the successful-login handler assigns the unvalidated to value to window.location.href and the javascript: URI executes in the kernel origin under the victim's authenticated session, able to call same-origin kernel APIs. A PoC reference exists in the GHSA advisory and was verified end to end by the reporter on SiYuan v3.8.6; it is not packaged as standalone working exploit code.