Description
SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | 2.9.0 – < 3.8.7 | 3.8.7 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter http/cves/2026/CVE-2026-116167.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- GitHub Security Advisory (GHSA-fmj3-xc2f-6w4w) vendor-advisory
- VulnCheck Advisory: SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter third-party-advisory