CVE-2026-82653

COMPONENT VERSION RANGE

NewScan fingerprints SiYuan from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-31 (/daily-cve). Two 9.3 ids fixed by the same release, so ONE row: two rows would be two findings that say 'upgrade to 3.8.1'. CVE-2026-82653 (GHSA-hvwp-43j9-4xgf) is confirmDialog() interpolating unescaped package names and notebook names directly into innerHTML; CVE-2026-82654 (GHSA-hf87-qh3j-3p88) is the same failure in the hint, backlink and breadcrumb renderers, reached by setting a block's name, alias or memo. Recorded `high`, not critical, and that is the calibration this repo already applies to stored XSS (the Open WebUI and Etherpad rows): script runs in the workspace owner's session with the full kernel API behind it - which on SiYuan means read/write of every notebook and the accessAuthCode - but the payload has to be planted first, through an installed marketplace package, a shared/imported notebook or a block the attacker can name. VERSION-MATCH ONLY: neither id can be confirmed in-band without writing a payload into someone's notes. The version arrives from the tech_signatures "SiYuan" version_from added the same day (GET /api/system/version, which answers anonymously even with the lock screen password set), and the gate was measured against both b3log/siyuan:v3.7.3 -> 3.7.3 (fires) and :v3.8.1 -> 3.8.1 (silent), so the row excludes the patched build rather than firing on every install.