CyberRota Analysis
AI-GeneratedSiYuan versions prior to 3.8.2 are vulnerable to a stored cross-site scripting (XSS) attack due to an inadequate blocklist for file extensions, allowing attackers to upload malicious files that can execute JavaScript. This vulnerability can lead to the theft of API tokens and compromise of user workspaces. Organizations using SiYuan should prioritize remediation to protect sensitive data and maintain the integrity of their applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.