Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-31 | 1 | Disclosure1 |
| 2026-09-04 | 1 | Patch1 |
🚨 HIGH: CVE-2026-82653 (CVSS 8.9) Stored XSS in SiYuan <v3.8.1 via unescaped package/notebook names in confirmDialog(). Attackers can execute malicious scripts through bazaar packages. ✅ Update to v3.8.1+ #CVE #Vulnerability #PatchNow https://t.co/5mkp2wmQgn
Post summary
The tweet announces the stored XSS vulnerability CVE‑2026‑82653 with a CVSS of 8.9 and urges users to update to version 3.8.1 or later.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 31 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Stored cross-site scripting in a self-hosted notes app — script runs in the workspace owner's session, with the whole kernel API behind it (SiYuan CVE-2026-82653, SiYuan CVE-2026-82654) 📦 XML external entity injection in a search engine's document parsers — a page the crawler was pointed at reads files off the machine running it (YaCy CVE-2026-82880) 🔎 Technology fingerprint for a self-hosted BI platform — the product is identifiable now, so advisories against it can be matched at all (DataEase) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #XSS #CSO #REDTEAM
Post summary
The post announces newly disclosed CVEs affecting self-hosted applications, describing specific vulnerability types such as XSS and XEE, without linking to PoCs, exploits, or patches.