5.4
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116169
SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks
siyuan · Cross-site scripting · CWE-79Affectedsiyuan
FixUpdate to 3.8.7 or newer
PublishedOct 25, 13:20 · VulnCheck
ScoredOct 25 · 5.4 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that mathRender assigns via innerHTML, executing script in the application origin when a reader clicks the rendered link.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed insiyuan2.10.0 – before 3.8.73.8.7siyuanNot affected3.8.7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known