Vulnerability in siyuan-note siyuan

[ Description ]Official description

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4w
• www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameter