What is GHSA-jvrf-pm5c-jgr4?

GHSA-jvrf-pm5c-jgr4 is a security advisory published by GitHub Security Advisories with High severity. SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the...

Which CVE IDs does GHSA-jvrf-pm5c-jgr4 cover?

GHSA-jvrf-pm5c-jgr4 covers the following CVE IDs: CVE-2026-116167. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jvrf-pm5c-jgr4?

GHSA-jvrf-pm5c-jgr4 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-jvrf-pm5c-jgr4HighCVSS 6.8

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the...

Vendor

GitHub Security Advisories

Published

October 25, 2026

Last Modified

October 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-116167 →

📋 Description

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4w
https://nvd.nist.gov/vuln/detail/CVE-2026-116167
https://www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameter
https://github.com/advisories/GHSA-jvrf-pm5c-jgr4