Cross-Site Scripting Flaw in SiYuan by SiYuan Technology

CVE-2026-116167

What is CVE-2026-116167?

SiYuan versions prior to 3.8.7 are susceptible to a cross-site scripting vulnerability located in the unauthenticated /check-auth endpoint. This security issue arises when the 'to' parameter is assigned to window.location.href without proper validation of the URL scheme. Attackers exploit this flaw by crafting a malicious link containing a javascript: URI, which is executed after a victim logs in. This could potentially allow the attacker to invoke kernel APIs, gaining unauthorized access to or modifying sensitive workspace content and settings, thereby posing significant risks to user data integrity and security.

References