CVE-2026-87813: SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.2
Event History
Frequently Asked Questions
Which users are exposed to the malicious script?
Users are exposed when they search assets and the Search Assets result list renders an asset filename containing malicious markup. The script executes in the victim's browser in SiYuan's same-origin context.
What access does an attacker need to exploit this issue?
The attacker must be authenticated and able to create or provide an asset with a crafted filename. Exploitation also requires a victim to search assets so that the crafted filename appears in the results.
What could successful exploitation allow?
The injected JavaScript can make same-origin API requests and manipulate application state using the victim's browser session. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.