Cyber & AI intelligence
Wasteland.
Briefs indexed2366
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-84803 2026-09-02

CVE-2026-84803: Stored XSS in SiYuan Asset Serving Lets Attackers Steal API Tokens

"The editorial note cuts off mid-sentence ("...3.8.2 fix boundary are "), so I can't tell whether those items were confirmed accurate or flagged for correction; I've assumed the former and preserved every factual claim…"

The editorial note cuts off mid-sentence ("...3.8.2 fix boundary are "), so I can't tell whether those items were confirmed accurate or flagged for correction; I've assumed the former and preserved every factual claim, per your "keep every claim not specifically flagged" constraint.

CVE-2026-84803: Stored XSS in SiYuan Asset Serving Lets Attackers Steal API Tokens

A stored cross-site scripting flaw in SiYuan before v3.8.2 allows uploaded files with overlooked script-capable extensions to execute JavaScript, exposing API tokens and enabling workspace compromise.

What Is It

CVE-2026-84803 is a stored cross-site scripting vulnerability (CWE-79) in the asset-serving path of SiYuan, the open-source notes application. The extension blocklist that governs uploaded assets is incomplete: it fails to account for a set of file types that browsers still resolve to executable media types.

An attacker who can upload an asset can use extensions such as .xht, .ehtml, .xsl, .xbl, or .rdf to get JavaScript executed in the context of the application when the asset is served back. From there, the payload can steal API tokens and compromise the workspace.

Why It Matters

The flaw carries a CVSS 3.1 base score of 9.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The vector is the story here: network-reachable, low attack complexity, only low privileges required, and, critically, a changed scope with high confidentiality, integrity, and availability impact. User interaction is required, but for a stored XSS delivered through a note-taking workspace, that bar is low.

The vendor also published a CVSS 4.0 score of 8.6 (High), with user interaction rated as passive; consistent with the CVSS 3.1 UI:R assessment, since the victim need only view an asset that is already stored in their own workspace.

Because the payload targets API tokens, successful exploitation escalates from a single rendered asset to durable programmatic access against the victim's workspace.

What's Vulnerable

Patch Status

Fixed in SiYuan v3.8.2. Upgrading to 3.8.2 or later is the remediation; the affected-version data lists 3.8.2 as unaffected. No CISA KEV entry accompanies this CVE, which means there is no federal remediation deadline at this time. Absence from KEV is not itself evidence that exploitation is not occurring; it reflects only that CISA has not catalogued confirmed in-the-wild use, and self-hosted note-taking deployments are the kind of target where exploitation can go unreported. NVD lists the record as Deferred, published 2026-09-02.

Sources