CVE-2026-82654: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siyuan-note siyuan

SiYuan versions prior to 3.8.1 do not properly neutralize input in certain fields (block name, alias, memo) used in rendering hints, backlinks, and breadcrumbs. This improper escaping leads to a cross-site scripting vulnerability where an attacker can embed executable scripts in these fields. When another user views a document that references or displays the affected block, the malicious script executes in their context, potentially compromising user security.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of another user's session when they view documents referencing the malicious block. This can lead to theft of user credentials, session hijacking, or other malicious actions depending on the script payload. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical impact with network attack vector, low attack complexity, and partial user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects versions before 3.8.1, so upgrading to version 3.8.1 or later is likely to address the issue once the vendor releases a fix. Until then, users should exercise caution when viewing documents with untrusted content referencing blocks with user-controlled names or aliases.