CVE-2026-87814: SiYuan before v3.8.2 Stored XSS via Asset Preview
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYuan origin when victims preview the assets, enabling authenticated API requests and workspace manipulation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.2 - Compensating control
Restrict access to workspaces/asset previews so attackers cannot place crafted text assets in a workspace (e.g., limit who can create/upload assets to trusted users/roles).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission or another way to place crafted text assets in a SiYuan workspace. Exploitation also requires a victim to preview the malicious asset through the search asset preview feature.
Are users exposed merely by having a malicious asset in a workspace?
No. The provided information indicates that JavaScript executes when a victim previews the crafted asset; user interaction is required.
What could successful exploitation allow?
Script runs in the SiYuan origin, allowing the attacker to make authenticated API requests as the victim and manipulate workspace content.
Which versions are affected?
SiYuan versions before 3.8.2 are affected. Updating to 3.8.2 or later addresses the affected version range described.