Executive brief
SiYuan is a popular open-source note-taking and knowledge management application. Before version 3.8.2, it was vulnerable to stored cross-site scripting (XSS) attacks in its asset serving mechanism. An attacker could upload malicious script files with specially crafted extensions (such as .xht, .ehtml, .xsl, .xbl, or .rdf) that bypass the security blocklist and execute JavaScript in victims' browsers, allowing theft of API tokens and complete compromise of workspace data including notebooks, configurations, and the ability to trigger remote code execution.
Technical details
The vulnerability is a stored XSS flaw in SiYuan's asset serving code (kernel/server/serve.go). The application uses a hardcoded extension blocklist to prevent inline serving of script-capable files, forcing them to be downloaded with Content-Disposition: attachment headers. However, the blocklist is incomplete and misses file extensions (.xht, .ehtml, .xsl, .xbl, .rdf) that Go's MIME type system recognizes and resolves to executable media types (application/xhtml+xml, text/html, text/xml, application/rdf+xml). An attacker can upload files with these extensions containing JavaScript payloads; when a workspace member opens the asset link, the script executes in the browser with the same origin as SiYuan, allowing the attacker to extract API tokens via the /api/system/getConf endpoint and subsequently perform privileged operations. The vulnerability is network-accessible and requires only user interaction (clicking the malicious asset link) but no authentication on the attacker's part. A patch is available in version 3.8.2.
Affected products
- SiYuan SiYuan before 3.8.2
Timeline
- 2026-08-19: disclosed: GitHub Security Advisory GHSA-7h8j-qw37-w46g published
- 2026-09-02: advisory: CVE-2026-84803 published on NVD
- 2026-08-19: patched: Fix released in v3.8.2