Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-31 | 1 | Disclosure1 |
| 2026-09-04 | 1 | Patch1 |
🚨 HIGH SEVERITY: CVE-2026-82654 (CVSS 8.9) SiYuan <v3.8.1 vulnerable to XSS via improper escaping in block name/alias/memo fields. Attackers can inject malicious scripts executed when users view affected documents. Patch immediately to v3.8.1+ #CVE #Vulnerability #PatchNow https://t.co/Y1zlRyntcV
Post summary
The tweet alerts users to a high‑severity XSS CVE (CVE‑2026‑82654) in SiYuan and urges immediate upgrade to v3.8.1 or later.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 31 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Stored cross-site scripting in a self-hosted notes app — script runs in the workspace owner's session, with the whole kernel API behind it (SiYuan CVE-2026-82653, SiYuan CVE-2026-82654) 📦 XML external entity injection in a search engine's document parsers — a page the crawler was pointed at reads files off the machine running it (YaCy CVE-2026-82880) 🔎 Technology fingerprint for a self-hosted BI platform — the product is identifiable now, so advisories against it can be matched at all (DataEase) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #XSS #CSO #REDTEAM
Post summary
NewNormal Security’s daily report announces several newly added CVEs with technical details, but does not provide PoCs, exploits, or patch information, indicating a Disclosure‑type update.