CVE-2026-82653: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siyuan-note siyuan

CVE-2026-82653 is a stored cross-site scripting vulnerability in SiYuan note-taking software prior to version 3.8.1. The flaw exists in the confirmDialog() function where unescaped user-controlled input (package names and notebook names) is interpolated directly into innerHTML assignments. Attackers can craft malicious bazaar packages with HTML or script payloads in the name field. When a user interacts with these packages by uninstalling them or unlocking encrypted notebooks, the malicious code executes in the user's browser context, potentially leading to session hijacking, data theft, or other browser-based attacks.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the victim's browser when uninstalling packages or unlocking encrypted notebooks. This can lead to theft of sensitive information, session hijacking, or other malicious actions within the user's browser session. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical impact with network attack vector, low attack complexity, and high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to SiYuan version 3.8.1 or later once available. Until a patch is released, avoid installing untrusted bazaar packages and be cautious when uninstalling packages or unlocking encrypted notebooks.