CVE-2026-84803

CriticalCVSS 9.0/10Last modified Sep 2, 2026

Description

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-848045.4Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoint CVE-2026-848054.3Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/user CVE-2026-848065.4Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit CVE-2026-848075.4Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. CVE-2026-848084.3Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enfor CVE-2026-848096.5Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories an CVE-2026-84819.9IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /CVE-2026-848106.5claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python CVE-2026-848116.5agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scan CVE-2026-848127.1Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.CVE-2026-848139.3Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.CVE-2026-848149.8Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.