CVE-2026-84803: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siyuan-note siyuan

CVE-2026-84803 is a stored cross-site scripting vulnerability in SiYuan note-taking software prior to version 3.8.2. The vulnerability is due to an incomplete extension blocklist in the asset serving component, which allows attackers to upload files with extensions that resolve to executable media types capable of running JavaScript. Exploitation can lead to theft of API tokens and compromise of user workspaces. The CVSS 4.0 base score is 8.6, indicating a high severity vulnerability with network attack vector, low attack complexity, and partial user interaction required.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the victim's browser, leading to theft of API tokens and potential compromise of user workspaces within the SiYuan application. This can result in unauthorized access and manipulation of user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates and apply any released patches or updates promptly. Until a fix is available, restricting file uploads to safe types and implementing additional input validation may reduce risk.