CVE-2026-87812: SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated SiYuan origin when users view Bazaar listings, enabling API requests and application state manipulation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.2 - Compensating control
After upgrading, monitor SiYuan Bazaar listings for malicious iconURL payloads and remove/clean any affected Bazaar package cards that may still contain stored XSS content.
Event History
Frequently Asked Questions
Which users are exposed to exploitation?
Authenticated SiYuan users are exposed when they view Bazaar listings containing a malicious package card. Exploitation requires user interaction because the victim must view the affected listing.
What does an attacker need to do to trigger the issue?
An attacker needs to place a crafted iconURL value in Bazaar package-card metadata. The malicious value can include event handlers that execute JavaScript when the card's image source is rendered.
What can successful script execution do?
The injected JavaScript runs in the authenticated SiYuan origin. It can make API requests and manipulate application state using the victim's authenticated context.
Which versions should be remediated?
SiYuan versions before 3.8.2 are affected. Upgrading to version 3.8.2 or later addresses the vulnerable handling of Bazaar iconURL metadata.