CVE-2026-82653: Siyuan-Note Siyuan

High severity, CVSS 8.9. EPSS: 0.4% chance of exploitation in the next 30 days.

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.

Affected products

• Siyuan-Note Siyuan: before 3.8.1 (fixed in 3.8.1)

Published 2026-08-30. Last modified 2026-09-02.