Is CVE-2026-116167 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116167 being exploited in the wild.

How severe is CVE-2026-116167?

Medium severity, with a CVSS score of 6.8, published 25 October 2026.

Is there a fix for CVE-2026-116167?

Yes: fixed in 3.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116167 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116167?

Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116167: SiYuan cross-site scripting in /check-auth redirect

CVE-2026-116167 · Severity: medium · CVSS 6.8 · Published 2026-10-25

SiYuan is a note-taking and knowledge management application. The /check-auth page, which handles user login, fails to validate a redirect parameter and allows attackers to inject malicious JavaScript code. An attacker can trick a user into clicking a crafted link and, once the user logs in, the injected script executes with the user's full session privileges, enabling data theft or modification of the user's workspace and settings.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-116167 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116167 being exploited in the wild.
How severe is CVE-2026-116167?: Medium severity, with a CVSS score of 6.8, published 25 October 2026.
Which products and versions are affected?: SiYuan 2.9.0 to 3.8.6.
Is there a fix for CVE-2026-116167?: Yes: fixed in 3.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116167 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116167?: Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.8.7

Technical details

The /check-auth page accepts an unauthenticated "to" query parameter and assigns it directly to window.location.href without validating the URL scheme, allowing javascript: URIs to execute. The vulnerability affects two code sinks: one in the HTTP fetch response handler and one in a WebSocket message handler. An attacker must convince the victim to visit a crafted URL and complete valid authentication; once the victim logs in, the injected script runs in the authenticated kernel origin and can invoke same-origin APIs to read or modify workspace content.

Affected products

SiYuan SiYuan 2.9.0 to 3.8.6

Timeline

2026-10-09: disclosed
2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.