Stored Cross-Site Scripting in SiYuan by SiYuan Note

CVE-2026-116169

What is CVE-2026-116169?

The vulnerability in SiYuan versions prior to 3.8.7 allows users with editing permissions to inject malicious scripts. This is done by storing JavaScript URLs in math block content rendered with KaTeX when trust is enabled. By using payloads such as \href, \url, or \includegraphics, an attacker can exploit innerHTML assignments in the mathRender function, leading to the execution of scripts in the application's origin when a user interacts with the rendered link. It is crucial for users to upgrade to the latest version to mitigate this risk.

References