Siyuan Through 3.8.4 Stored Xss Via Heading Style Attribute

Back www.vulncheck.com

Siyuan Through 3.8.4 Stored Xss Via Heading Style Attribute

www.vulncheck.com • September 19, 2026

Share: View original

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

GitHub Security Advisory (GHSA-928g-4hfq-qwvx)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Siyuan 3.8.4 XSS Vulnerabilities Exploited via Notebook Names and Heading Styles Two distinct stored Cross-Site Scripting (XSS) vulnerabilities have been identified in Siyuan version 3.8.4. The vulnerabilities are triggered through malicious notebook names and heading style attributes. Both vulnerabilities fall under CWE-79, indicating improper neutralization of input during web page generation. Affected users may face risks of data theft, session hijacking, and other malicious actions. The vulnerabilities have been documented in GitHub Security Advisories GHSA-8c2m-33v9-vvqm and GHSA-928g-4hfq-qwvx. Currently, there is no indication of active exploitation in the wild, but the potential for abuse exists. Security professionals are advised to monitor their systems for these vulnerabilities. Patching is recommended to mitigate risks associated with these flaws. 37

Extracted Entities

CWE Weaknesses (1)

CWE-79 - Cross-site Scripting (xss)

Vulnerabilities (2)